CVE-2026-81581: WibuKey Driver DoS Vulnerability

CVE-2026-81581 Overview

CVE-2026-81581 is an improper memory boundary validation vulnerability in the WibuKey64.sys kernel driver shipped with WibuKey up to version 6.70 for Windows. An attacker with local access can set pointers outside the intended program scope, corrupting kernel memory. The primary outcome is denial of service, but the vendor cannot rule out remote code execution or privilege escalation because the driver runs with SYSTEM privileges. The flaw is tracked under CWE-119 — improper restriction of operations within the bounds of a memory buffer.

Critical Impact
A local attacker can trigger memory corruption in a SYSTEM-privileged kernel driver, potentially escalating from denial of service to code execution in kernel context.

Affected Products

WIBU-SYSTEMS WibuKey for Windows, versions up to and including 6.70
WibuKey64.sys kernel-mode driver
Any Windows host with the vulnerable WibuKey runtime installed for licensing or dongle support

Discovery Timeline

2026-08-27 - CVE-2026-81581 published to NVD
2026-08-27 - Last updated in NVD database
Vendor advisory: WIBU Security Advisory #100057

Technical Details for CVE-2026-81581

Vulnerability Analysis

The vulnerability resides in WibuKey64.sys, a Windows kernel-mode driver that processes I/O control requests from user-mode applications. The driver fails to validate memory boundaries when consuming attacker-controlled pointer values. A local, authenticated user can send crafted DeviceIoControl requests that direct the driver to read or write outside the intended buffer scope.

Because the driver executes in ring 0 with SYSTEM privileges, out-of-bounds pointer manipulation crosses a security boundary from the low-privileged caller into the kernel. The scope change reflects that any successful exploitation impacts confidentiality, integrity, and availability of the entire host, not just the caller's process.

Root Cause

The root cause is missing or insufficient validation of pointer values supplied through IOCTL input buffers before those pointers are dereferenced inside the driver. This matches [CWE-119], where operations are performed on a buffer using an index or pointer that references memory outside the allocated region. The advisory does not disclose the specific IOCTL codes or dispatch routines involved.

Attack Vector

Exploitation requires local access and a low-privileged user context on a Windows system where WibuKey is installed. The attacker opens a handle to the WibuKey device object and issues crafted IOCTL requests containing malformed pointer or size fields. The driver dereferences the attacker-controlled value without bounds checking, corrupting kernel memory.

The most reliable outcome is a bugcheck resulting in denial of service. The vendor advisory notes that remote code execution and privilege escalation cannot be ruled out, since kernel memory corruption in a SYSTEM-privileged driver is a well-known primitive for privilege escalation. See the WIBU Security Advisory #100057 for vendor guidance.

Detection Methods for CVE-2026-81581

Indicators of Compromise

Unexpected system bugchecks referencing WibuKey64.sys in MEMORY.DMP or minidump files
Windows Error Reporting entries for kernel faults with WibuKey64.sys on the call stack
Loaded driver inventory showing WibuKey64.sys at version 6.70 or earlier

Detection Strategies

Inventory endpoints for the presence and version of WibuKey64.sys and cross-reference with the vendor advisory
Alert on user-mode processes opening handles to the WibuKey device object followed by high-frequency DeviceIoControl calls
Monitor for kernel bugchecks (BSOD codes such as 0x0000003B, 0x0000007E, 0x0000001E) coinciding with WibuKey driver activity

Monitoring Recommendations

Enable kernel crash dump collection and forward dump metadata to a central SIEM for triage
Track anomalous local privilege transitions from standard user contexts to SYSTEM on hosts running WibuKey
Correlate driver load events (Windows Event ID 6 in the Microsoft-Windows-Kernel-PnP and driver framework channels) with process telemetry to catch abuse patterns

How to Mitigate CVE-2026-81581

Immediate Actions Required

Identify all Windows systems with WibuKey installed and confirm the installed version of WibuKey64.sys
Upgrade WibuKey to a fixed release as directed in WIBU Security Advisory #100057
Restrict local logon and interactive access on hosts running WibuKey to trusted administrators only
Enable kernel Driver Verifier on a representative test host to surface additional out-of-bounds access patterns during validation

Patch Information

WIBU-SYSTEMS has published Security Advisory #100057 addressing the memory boundary validation issue in WibuKey64.sys. Administrators should follow the vendor's guidance to update to a version later than 6.70. Refer to the WIBU Security Advisory #100057 for the specific fixed release and upgrade procedure.

Workarounds

If patching is not immediately possible, uninstall WibuKey on systems that do not require dongle or license runtime services
Apply the Microsoft Vulnerable Driver Blocklist policy where the vendor-provided fixed driver is not yet deployed
Enforce application control (Windows Defender Application Control or AppLocker) to prevent unauthorized processes from opening handles to the WibuKey device object
Limit local user rights and remove standard users from workstations that must retain the vulnerable driver until a patched version is installed

bash

# Enumerate WibuKey driver version on Windows hosts (PowerShell)
Get-CimInstance Win32_SystemDriver -Filter "Name='WibuKey'" |
    Select-Object Name, PathName, State, StartMode

Get-Item "$env:SystemRoot\System32\drivers\WibuKey64.sys" |
    Select-Object FullName, @{n='Version';e={$_.VersionInfo.FileVersion}}