CVE-2026-19382: Almico Speedfan Memory Leak Vulnerability

CVE-2026-19382 Overview

CVE-2026-19382 is a memory leak vulnerability [CWE-401] in Almico SpeedFan 4.52. The flaw resides in the KiSystemCall64 function within the speedfan.sys kernel driver, specifically in the MSR (Model-Specific Register) Index Handler component. Local attackers with high privileges can trigger the leak by manipulating input to the driver.

The vulnerability requires local access and elevated privileges to exploit. A public exploit has been released, and the vendor did not respond to disclosure attempts. While the direct impact is limited to availability degradation through resource exhaustion, the presence of an unpatched signed driver raises broader Bring Your Own Vulnerable Driver (BYOVD) concerns.

Critical Impact
Local exploitation of speedfan.sys can cause kernel memory exhaustion and system instability. No vendor patch is available.

Affected Products

Almico SpeedFan 4.52
Component: speedfan.sys kernel driver
Function: KiSystemCall64 in MSR Index Handler

Discovery Timeline

2026-08-10 - CVE-2026-19382 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-19382

Vulnerability Analysis

The vulnerability is a memory leak [CWE-401] in the speedfan.sys driver shipped with Almico SpeedFan 4.52. SpeedFan is a Windows utility for monitoring hardware sensors and controlling fan speeds. The bundled kernel driver exposes IOCTL interfaces that allow user-mode components to read and write MSRs.

When a caller invokes the driver through the KiSystemCall64 path, the MSR Index Handler allocates kernel resources tied to the request. Repeated invocations with crafted parameters cause allocated memory to remain unreleased. Over time, the accumulated allocations degrade system performance and can exhaust nonpaged pool.

Root Cause

The root cause lies in missing cleanup logic within the MSR Index Handler code path. Kernel objects or buffers allocated during request processing are not freed on all return paths. This mismatch between allocation and deallocation produces the leak each time the affected handler runs.

Attack Vector

Exploitation requires local access with high privileges on a system where SpeedFan 4.52 is installed and its driver loaded. An attacker issues repeated IOCTL requests to speedfan.sys that traverse the vulnerable MSR Index Handler code path. The attack does not require user interaction and does not affect confidentiality or integrity directly. A public exploit is available, according to the VulDB advisory.

No verified proof-of-concept code has been reviewed here. Refer to the VulDB CVE-2026-19382 entry for additional technical detail.

Detection Methods for CVE-2026-19382

Indicators of Compromise

Presence of speedfan.sys version corresponding to SpeedFan 4.52 on endpoints where the utility is not required.
Sustained growth in nonpaged pool memory on hosts where speedfan.sys is loaded.
Repeated DeviceIoControl calls targeting the SpeedFan device object from non-administrative user contexts attempting privilege abuse.

Detection Strategies

Inventory endpoints for installations of Almico SpeedFan 4.52 and the speedfan.sys driver hash.
Alert on driver load events for speedfan.sys on systems that have no operational need for hardware monitoring.
Correlate kernel pool growth metrics with process activity that opens handles to the SpeedFan driver.

Monitoring Recommendations

Monitor Windows performance counters for Pool Nonpaged Bytes trends on hosts running SpeedFan.
Enable Sysmon Event ID 6 (driver loaded) and forward events to a SIEM for correlation.
Track process creation events invoking SpeedFan binaries under unexpected user accounts.

How to Mitigate CVE-2026-19382

Immediate Actions Required

Uninstall Almico SpeedFan 4.52 from endpoints that do not require hardware monitoring.
Add speedfan.sys to the Microsoft Vulnerable Driver Blocklist or an equivalent WDAC policy where operationally acceptable.
Restrict local administrative access to reduce the population of accounts capable of triggering the flaw.

Patch Information

No vendor patch is available. According to the disclosure, Almico was contacted but did not respond. Organizations should treat SpeedFan 4.52 as an unmaintained component and plan for removal or replacement. Track updates through the VulDB advisory.

Workarounds

Prevent speedfan.sys from loading using Windows Defender Application Control (WDAC) or the Microsoft recommended driver block rules.
Remove local administrator rights from standard users to raise the bar for exploitation.
Reboot affected systems periodically to reclaim leaked kernel memory until the driver is removed.

bash

# Example: Query for speedfan.sys presence via PowerShell
Get-ChildItem -Path C:\ -Recurse -Filter speedfan.sys -ErrorAction SilentlyContinue |
    Select-Object FullName, Length, LastWriteTime