CVE-2026-94128: BioStar VIVID LED DJ Privilege Escalation

CVE-2026-94128 Overview

CVE-2026-94128 is a write-what-where vulnerability in BioStar VIVID LED DJ version 4.0.2411.1500. The flaw resides in the sub_1105C function within the BS_LED64.sys kernel driver, specifically in its IOCTL handler. Attackers manipulate the AssociatedIrp argument to trigger arbitrary kernel memory writes. Local access is required for exploitation, but successful attacks compromise confidentiality, integrity, and availability at the kernel level. The exploit has been publicly disclosed. The vendor was contacted about the issue but did not respond. This vulnerability is classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer).

Critical Impact
A local attacker can achieve SYSTEM-level code execution by exploiting the write-what-where condition in the vulnerable kernel driver, enabling full compromise of the host.

Affected Products

BioStar VIVID LED DJ 4.0.2411.1500
Component: BS_LED64.sys kernel driver
IOCTL handler function sub_1105C

Discovery Timeline

2026-09-21 - CVE-2026-94128 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-94128

Vulnerability Analysis

The vulnerability affects the BS_LED64.sys driver shipped with BioStar VIVID LED DJ 4.0.2411.1500. The driver exposes an IOCTL interface accessible to user-mode processes. Inside the handler routine sub_1105C, the driver processes an I/O Request Packet (IRP) without validating fields inside the AssociatedIrp structure. An attacker crafts a malicious IRP that instructs the driver to write attacker-controlled data to an attacker-controlled kernel address. This condition is commonly called a write-what-where primitive. Once achieved in kernel mode, it enables direct manipulation of kernel structures such as _EPROCESS tokens, service function pointers, or callback tables. The result is arbitrary kernel-mode code execution or privilege elevation from a low-privileged local account to SYSTEM.

Root Cause

The root cause is missing input validation in the IOCTL handler. The AssociatedIrp buffer supplies both the destination address and the value to be written, and the driver trusts these values without bounds checking. This maps directly to [CWE-119], where operations occur outside the intended memory buffer boundaries.

Attack Vector

Exploitation requires local, authenticated access to a system where the vulnerable driver is loaded. An attacker opens a handle to the driver device object, then issues DeviceIoControl calls containing the crafted IRP. No user interaction is required beyond code execution in a low-privileged process. Public disclosure of the exploit lowers the barrier to weaponization.

// No verified proof-of-concept code is published in the NVD entry.
// Refer to the VulDB reference for technical details.

Detection Methods for CVE-2026-94128

Indicators of Compromise

Presence of BS_LED64.sys version 4.0.2411.1500 on endpoints not running BioStar VIVID LED DJ workloads
Unexpected loading of the BS_LED64.sys driver by processes other than the legitimate BioStar installer or service
Low-privileged processes opening a handle to the BS_LED64 device object followed by DeviceIoControl calls

Detection Strategies

Enumerate loaded kernel drivers across the fleet and flag hosts where BS_LED64.sys is present or loaded on demand.
Monitor for suspicious IOCTL traffic patterns targeting the BS_LED64 device object, especially from non-BioStar parent processes.
Correlate driver load events with subsequent token manipulation or privilege escalation activity in process telemetry.

Monitoring Recommendations

Enable Windows kernel driver load auditing (Sysmon Event ID 6) and forward events to a centralized analytics platform.
Track creation of new SYSTEM-level processes spawned by non-service user accounts as a downstream indicator of successful exploitation.
Alert on installation of vulnerable driver versions through software inventory or endpoint management tooling.

How to Mitigate CVE-2026-94128

Immediate Actions Required

Inventory endpoints for BioStar VIVID LED DJ 4.0.2411.1500 and the BS_LED64.sys driver, then remove the software where it is not required.
Restrict local logon rights and enforce least privilege to reduce the population of accounts able to invoke IOCTLs against the driver.
Deploy Microsoft's Vulnerable Driver Blocklist and add BS_LED64.sys to the Windows Defender Application Control (WDAC) blocklist where feasible.

Patch Information

No vendor patch is available. According to the disclosure, the vendor was contacted but did not respond. Organizations should treat the affected driver as unfixable in its current form and plan removal or compensating controls. Monitor the VulDB CVE-2026-94128 entry for future advisories.

Workarounds

Uninstall BioStar VIVID LED DJ from systems that do not require the LED control functionality.
Block loading of BS_LED64.sys via Microsoft's recommended vulnerable driver blocklist or a WDAC code integrity policy.
Apply application allowlisting to prevent unsigned or low-integrity processes from invoking DeviceIoControl against the BS_LED64 device.

bash

# Example: enable Microsoft Vulnerable Driver Blocklist via PowerShell (Windows 11 / Server 2022+)
# Run in an elevated session
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\CI\Config' -Name 'VulnerableDriverBlocklistEnable' -Value 1 -Type DWord