CVE-2026-81579 Overview
CVE-2026-81579 is a local privilege escalation vulnerability in the WibuKey2_64.sys kernel driver shipped with WibuKey for Windows before version 6.71. The driver performs an untrusted pointer dereference that attackers can weaponize as a write-what-where primitive in kernel memory. A local, authenticated user can leverage this primitive to execute arbitrary code in kernel context, spawn an administrator shell, or take full control of the affected host. The flaw is tracked under CWE-123: Write-what-where Condition.
Critical Impact
Local attackers with low-privileged access can escalate to SYSTEM and gain full control of Windows 64-bit endpoints running vulnerable WibuKey installations.
Affected Products
- WibuKey for Windows (64-bit) versions prior to 6.71
- WibuKey2_64.sys kernel driver bundled with WibuKey runtime
- Windows endpoints where the vulnerable driver is loaded, including systems running licensed applications that depend on WibuKey
Discovery Timeline
- 2026-08-27 - CVE-2026-81579 published to the National Vulnerability Database
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-81579
Vulnerability Analysis
The vulnerability resides in the WibuKey2_64.sys kernel driver, which exposes an I/O control interface reachable from user mode. The driver dereferences a pointer supplied by the caller without validating that the pointer references memory the caller is entitled to access. Because the driver executes in ring 0, any memory write it performs on the attacker's behalf occurs with full kernel privileges.
This condition is classified as a write-what-where primitive [CWE-123]. An attacker chooses both the target address and the value written. In practice, this pattern is used to overwrite kernel structures such as process tokens, function pointers in the System Service Descriptor Table, or callback pointers, transforming a driver bug into a reliable path to SYSTEM.
Root Cause
The root cause is missing validation of user-supplied pointers before dereferencing them inside a privileged IOCTL handler. The driver treats input buffers or embedded pointer fields as trusted, bypassing the standard ProbeForRead and ProbeForWrite checks that Windows kernel developers must apply to untrusted input. This design flaw allows a low-privileged process to direct arbitrary kernel writes.
Attack Vector
Exploitation requires local access and low-privileged code execution on the target host. The attacker opens a handle to the driver's device object and issues a crafted DeviceIoControl request whose payload steers the driver into dereferencing an attacker-chosen kernel address. By repeatedly invoking the primitive, the attacker corrupts kernel state to elevate the current process token or hijack kernel control flow. No user interaction is required, and the attack changes the security scope of the process, yielding administrative control.
No verified public proof-of-concept is currently linked to this CVE. Technical specifics are documented in the Wibu Security Advisory WIBU-100031.
Detection Methods for CVE-2026-81579
Indicators of Compromise
- Presence of WibuKey2_64.sys on disk with a file version earlier than 6.71
- Unexpected user-mode processes opening handles to the WibuKey driver device object
- New administrative accounts, services, or scheduled tasks created shortly after WibuKey driver activity from a non-administrative process
- Kernel crashes or bugchecks referencing WibuKey2_64.sys in memory dumps
Detection Strategies
- Inventory endpoints for the vulnerable driver by hashing and version-checking WibuKey2_64.sys across the fleet
- Alert on DeviceIoControl calls from low-integrity or non-administrative processes targeting the WibuKey device
- Correlate token-privilege changes (for example, a process suddenly acquiring SeDebugPrivilege or SYSTEM identity) with recent driver interactions
- Hunt for suspicious child processes spawned by applications that legitimately consume WibuKey licensing services
Monitoring Recommendations
- Ingest Sysmon Event ID 6 (driver load) and Event ID 1 (process create) into your SIEM to track driver presence and post-exploit process trees
- Monitor Windows kernel telemetry for anomalous IOCTL patterns and driver-related bugchecks
- Track privilege escalation events (Security Event ID 4672) that follow interaction with the WibuKey device object
How to Mitigate CVE-2026-81579
Immediate Actions Required
- Upgrade WibuKey for Windows to version 6.71 or later on every affected endpoint
- Identify third-party applications that bundle WibuKey and coordinate with those vendors for updated installers
- Restrict local logon and interactive access on systems running the vulnerable driver until patching completes
- Review recent privilege escalation and admin account creation events on hosts where the vulnerable driver has been present
Patch Information
Wibu-Systems addressed the vulnerability in WibuKey 6.71. Administrators should deploy the updated WibuKey runtime distributed through the vendor and verify that WibuKey2_64.sys reports version 6.71 or newer after installation. Full remediation details are in the Wibu Security Advisory WIBU-100031.
Workarounds
- Where immediate patching is not possible, uninstall WibuKey on hosts that do not require licensed applications dependent on it
- Block loading of the vulnerable WibuKey2_64.sys version using Windows Defender Application Control or a code-integrity policy that enforces a minimum driver version
- Enforce least privilege so that untrusted users cannot execute arbitrary binaries locally on systems where the driver remains loaded
# Verify installed WibuKey driver version on a Windows host
powershell -Command "Get-Item 'C:\\Windows\\System32\\drivers\\WibuKey2_64.sys' | " ^
"Select-Object -ExpandProperty VersionInfo"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
