EUVD-2026-66984
GHSA-gqq4-6ppr-52p5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconGain low-privileged local session
-
DeliveryEnumerate WibuKey2_64.sys driver handle
-
ExploitSend crafted IOCTL with malicious pointer
-
InstallTrigger untrusted pointer dereference in ring-0
-
C2Write arbitrary value to kernel memory address
-
ExecuteOverwrite SYSTEM security token in target process
-
ImpactSpawn SYSTEM-level shell
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Write-what-where prevention
|
| Exploitation Conditions | Exploitation requires a low-privileged (non-administrator) interactive or remote-desktop session on a 64-bit Windows system with WibuKey software installed and the WibuKey2_64.sys driver loaded. The driver must be present and running - i.e., WibuKey software must be actively installed, not merely present on disk. No special configuration beyond a default WibuKey installation is required: any system deploying WibuKey for dongle-based licensing is exposed if running a version prior to 6.71. No user interaction is required beyond the attacker having the ability to make IOCTL calls to the driver (standard for any local user). Limiting factors: exploitation is confined to 64-bit Windows; the attacker must already have local code execution at low privilege; remote-only attackers without a foothold cannot exploit this vulnerability directly. |
| Impact | The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) accurately reflects the exploitation profile: local unprivileged access is sufficient, exploitation complexity is low, no user interaction is required, and the scope change (S:C) captures the kernel boundary crossing from user-mode to SYSTEM. The 8.8 base score is calibrated correctly for a kernel LPE with full C/I/A impact. No EPSS data was provided, and the CVE is absent from CISA KEV, suggesting it has not been observed in active threat campaigns as of this analysis. However, write-what-where primitives in kernel drivers are historically very reliable exploitation targets and have been weaponized in ransomware and APT toolkits (e.g., BYOVD techniques). The real-world priority is high for any environment where standard users operate workstations with WibuKey installed - which is common in industrial, medical device, and specialized engineering software contexts where this dongle system is prevalent. |
| Exploit ScenarioDerived | An attacker with a standard Windows user account on a 64-bit workstation where WibuKey is installed sends a crafted DeviceIoControl request to WibuKey2_64.sys containing a malicious pointer value. The driver dereferences this pointer in ring-0 without validation, giving the attacker a write-what-where primitive in kernel memory; the attacker then overwrites a security token or DACL structure to elevate their process to NT AUTHORITY\SYSTEM, then spawns an elevated command shell. No POC has been publicly identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 27, 2026
Local privilege escalation in WibuKey for Windows before 6.71 allows any low-privileged local user to gain full SYSTEM-level control by exploiting a write-what-where primitive in the WibuKey2_64.sys kernel driver. The root cause is an untrusted pointer dereference (CWE-123) in the 64-bit kernel driver, meaning attacker-controlled data is used directly as a kernel-space pointer, enabling arbitrary writes into kernel memory - a classic and highly reliable LPE primitive. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
RemediationAI
The primary fix is to upgrade WibuKey to version 6.71 or later, as confirmed by the WIBU-SYSTEMS AG advisory at https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-100031.pdf. If immediate upgrade is not feasible - for example in environments where the dongle driver version is tied to a qualified industrial or medical software stack - compensating controls should include restricting interactive local logon to the affected workstations to trusted administrator accounts only, since exploitation requires PR:L (a standard low-privileged local user session). Additionally, disabling direct IOCTL access to the WibuKey driver for non-administrative users via Windows security descriptor hardening can raise the bar, though this may impact dongle-protected application functionality. Endpoint detection rules for anomalous kernel driver IOCTL patterns or unexpected privilege escalation sequences should be deployed as a detective control in the interim.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WibuKey is WIBU-SYSTEMS AG's hardware-based software protection and licensing platform, relying on a Windows kernel driver (WibuKey2_64.sys) to mediate access to the WibuKey dongle and enforce license checks. CWE-123 (Write-what-where Condition) describes a memory corruption class where the attacker controls both the destination address and the value written in a memory write operation - in kernel space this is particularly severe because it bypasses OS security boundaries. The affected CPE (cpe:2.3:a:wibu-systems-ag:wibukey:*:*:*:*:*:*:*:*) covers all WibuKey versions prior to 6.71 on 64-bit Windows. The kernel driver is the attack surface; it is reachable from user-mode via DeviceIoControl calls, and the untrusted pointer originates from attacker-controlled IOCTL input that is not validated before being dereferenced in ring-0 context.
Know when Wibukey gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Local low-privileged user reaches kernel driver via IOCTL; S:C reflects ring-0 boundary crossing granting full OS control.
Primary rating from Vendor (wibu).
CVSS VectorVendor: wibu
Lifecycle Timeline
2DescriptionCVE.org
In WibuKey for Windows before version 6.71, an untrusted pointer dereference in the WibuKey2_64.sys kernel driver for 64-bit Windows allows an attacker to exploit a write-what-where primitive, enabling local privilege escalation. This can be leveraged to execute arbitrary code, run an administrator shell, or gain full control over the system.
Executive ViewAI
WibuKey for Windows (versions before 6.71) contains a kernel driver vulnerability enabling local privilege escalation to SYSTEM level, potentially compromising entire Windows systems and protected applications. Organizations running WibuKey should prioritize inventory and risk assessment, as successful exploitation could grant attackers full system control and access to proprietary applications relying on WibuKey's protection.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict local login privileges to minimize attack surface; enable Windows Defender Application Guard and Exploit Guard; implement kernel-mode code integrity and hypervisor-protected code integrity; monitor kernel driver access and Event Viewer logs for exploitation indicators; consider temporary network isolation for systems running sensitive protected applications pending patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Wibukey versions up to 6.51 contains a vulnerability that allows attackers to potentially execute arbitrary code (CVSS 7
WibuKey64.sys kernel-mode driver in Wibu-Systems WibuKey up to version 6.70 for Windows allows a local, low-privileged a
An issue was discovered in WibuKey64.sys in WIBU-SYSTEMS WibuKey before v6.70 and fixed in v.6.70. Rated high severity (
An issue was discovered in WibuKey64.sys in WIBU-SYSTEMS WibuKey before v6.70 and fixed in v.6.70 An improper bounds che
Exploit-DB