CVE-2025-70616: Dieboldnixdorf Wnbios64.sys Overflow Flaw

CVE-2025-70616 Overview

CVE-2025-70616 is a stack buffer overflow vulnerability in the Wincor Nixdorf wnBios64.sys kernel driver version 1.2.0.0. The flaw resides in the IOCTL handler for code 0x80102058, which fails to validate the user-controlled Options parameter before copying data into a 40-byte stack buffer using memmove. Local attackers can send a crafted IOCTL request with Options > 40 to corrupt the kernel stack. Successful exploitation can result in kernel code execution, local privilege escalation, or a system crash. The same handler can also leak kernel addresses and adjacent stack contents when reads extend beyond buffer boundaries.

Critical Impact

Local attackers can trigger kernel-mode memory corruption in wnBios64.sys, enabling privilege escalation to SYSTEM, kernel code execution, or denial of service on affected Diebold Nixdorf systems.

Affected Products

• Diebold Nixdorf wnBios64.sys kernel driver version 1.2.0.0
• Systems with the vulnerable Wincor Nixdorf BIOS management driver installed
• ATM and point-of-sale platforms shipping the affected driver build

Discovery Timeline

• 2026-03-05 - CVE-2025-70616 published to NVD
• 2026-03-10 - Last updated in NVD database

Technical Details for CVE-2025-70616

Vulnerability Analysis

The vulnerability is classified under [CWE-121: Stack-based Buffer Overflow]. The wnBios64.sys driver exposes an IOCTL interface to user mode that includes handler code 0x80102058. When this handler processes input from a DeviceIoControl request, it reads an attacker-controlled length value named Options and passes it directly to memmove. The destination is a fixed 40-byte stack buffer declared as Src[40].

Because no upper bound check is performed on Options, supplying any value greater than 40 causes the copy to overrun the buffer and overwrite adjacent stack frames. Overwritten data includes saved return addresses, function pointers, and locals used elsewhere in the driver. The same handler also returns data from the buffer to user mode, which permits out-of-bounds reads that leak kernel pointers and stack contents useful for bypassing Kernel Address Space Layout Randomization (KASLR).

Root Cause

The root cause is missing input validation. The handler trusts the Options field from the IRP buffer as the byte count for memmove without comparing it to sizeof(Src). This pattern violates secure kernel coding practices, which require strict length validation on every IOCTL input before invoking memory copy primitives.

Attack Vector

Exploitation requires local access and the ability to open a handle to the driver's device object. An authenticated low-privileged user issues a DeviceIoControl call to IOCTL 0x80102058 with a crafted input buffer where the Options field exceeds 40. Attackers typically chain the information disclosure primitive to defeat KASLR, then deliver a controlled stack overwrite to redirect execution to a kernel ROP chain or shellcode, ultimately elevating to NT AUTHORITY\SYSTEM.

The vulnerability mechanism is documented in the public proof-of-concept at the GitHub PoC Repository. No synthetic exploit code is reproduced here.

Detection Methods for CVE-2025-70616

Indicators of Compromise

• Presence of wnBios64.sys version 1.2.0.0 on systems that do not require Diebold Nixdorf BIOS management
• Unexpected user-mode processes opening handles to the \\.\wnBios device object
• Kernel bug check events referencing wnBios64.sys in the faulting module field
• Unsigned or low-reputation binaries issuing DeviceIoControl calls with IOCTL 0x80102058

Detection Strategies

• Inventory endpoints for wnBios64.sys using file hash and version queries across managed fleets
• Monitor for handle-open events to the driver's device namespace from non-vendor processes
• Hunt for processes invoking DeviceIoControl with control code 0x80102058 and oversized input buffers
• Correlate driver load events with subsequent privilege escalation indicators on the same host

Monitoring Recommendations

• Enable Windows Defender Application Control or Microsoft Vulnerable Driver Blocklist policies and verify wnBios64.sys is included
• Forward Sysmon Event ID 6 (driver loaded) and Event ID 1 (process creation) to a centralized SIEM for analysis
• Alert on kernel-mode crashes followed by suspicious child process creation from low-privileged accounts
• Track local privilege escalation telemetry such as token duplication and SYSTEM-context process spawns on workstations where the driver is present

How to Mitigate CVE-2025-70616

Immediate Actions Required

• Identify all hosts with wnBios64.sys version 1.2.0.0 and remove the driver where Diebold Nixdorf BIOS management is not required
• Add the vulnerable driver to the Microsoft Vulnerable Driver Blocklist or an equivalent application control policy
• Restrict local logon and limit administrative privileges on systems that must retain the driver
• Monitor the vendor's security advisory channels for a fixed driver release

Patch Information

No vendor advisory or patched driver version is referenced in the NVD entry at the time of publication. Operators should contact Diebold Nixdorf for a remediated build of wnBios64.sys and validate signatures before deployment. Until a fixed version is available, rely on driver blocklisting and access controls to reduce exposure.

Workarounds

• Block the driver from loading using Windows Defender Application Control (WDAC) or AppLocker policies targeting the file hash of wnBios64.sys 1.2.0.0
• Restrict the device object's DACL so only SYSTEM and authorized administrative accounts can open handles to the driver
• Disable or uninstall the Diebold Nixdorf BIOS utility on endpoints where it is not actively used
• Enforce least privilege and remove local administrator rights from standard users to limit pre-exploitation reconnaissance

# Example: Query for the vulnerable driver across a Windows fleet
Get-CimInstance Win32_SystemDriver -Filter "Name='wnBios64'" |
  Select-Object Name, PathName, State, StartMode

# Example: Compute the file hash for blocklisting in WDAC policy
Get-FileHash -Algorithm SHA256 C:\Windows\System32\drivers\wnBios64.sys