Vivid Led Dj
Monthly
A write-what-where flaw in the BS_LED64.sys kernel driver shipped with BioStar VIVID LED DJ 4.0.2411.1500 lets an authenticated local user on a Windows host escalate to SYSTEM-level privileges by sending a crafted IOCTL that causes the driver to write attacker-controlled data to an attacker-chosen kernel address. The defect sits in the driver's IOCTL handler (sub_1105C), where the AssociatedIrp value is used without adequate validation, and the CVSS 4.0 base score of 8.5 (assessed as CVSS:3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects total loss of confidentiality, integrity, and availability of the host. Publicly available exploit code exists and was released after the vendor was contacted and failed to respond; it is not confirmed actively exploited (not in CISA KEV). The realistic attack surface is limited: the attacker must already hold standard-user code execution and the RGB control utility and its signed driver must be present, though the signed BS_LED64.sys also functions as a bring-your-own-vulnerable-driver (BYOVD) candidate on machines where the product is not installed.
A write-what-where flaw in the BS_LED64.sys kernel driver shipped with BioStar VIVID LED DJ 4.0.2411.1500 lets an authenticated local user on a Windows host escalate to SYSTEM-level privileges by sending a crafted IOCTL that causes the driver to write attacker-controlled data to an attacker-chosen kernel address. The defect sits in the driver's IOCTL handler (sub_1105C), where the AssociatedIrp value is used without adequate validation, and the CVSS 4.0 base score of 8.5 (assessed as CVSS:3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects total loss of confidentiality, integrity, and availability of the host. Publicly available exploit code exists and was released after the vendor was contacted and failed to respond; it is not confirmed actively exploited (not in CISA KEV). The realistic attack surface is limited: the attacker must already hold standard-user code execution and the RGB control utility and its signed driver must be present, though the signed BS_LED64.sys also functions as a bring-your-own-vulnerable-driver (BYOVD) candidate on machines where the product is not installed.