CVE-2026-94129: BioStar VALKYRIE Write-What-Where Vulnerability

CVE-2026-94129 Overview

CVE-2026-94129 is a write-what-where vulnerability in BioStar VALKYRIE AURORA 2.10.2411.0800. The flaw resides in the sub_1105C function of BS_RVSIO64.sys, a kernel-mode driver that exposes an IOCTL handler. A local attacker can manipulate the PhysicalAddress argument passed through the IOCTL interface to write attacker-controlled data to arbitrary kernel memory locations. The vulnerability maps to CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer. Public exploit details are available, and the vendor did not respond to disclosure attempts.

Critical Impact
Successful exploitation enables local privilege escalation to SYSTEM through arbitrary kernel memory writes, allowing full compromise of the affected host.

Affected Products

BioStar VALKYRIE AURORA 2.10.2411.0800
Component: BS_RVSIO64.sys kernel driver
Vulnerable function: sub_1105C IOCTL handler

Discovery Timeline

2026-09-21 - CVE-2026-94129 published to the National Vulnerability Database
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-94129

Vulnerability Analysis

The vulnerability exists in the IOCTL handler implemented by sub_1105C inside BS_RVSIO64.sys. The driver accepts a PhysicalAddress argument from user mode without sufficient validation. An attacker with local access can craft an IOCTL request that instructs the driver to write attacker-supplied data to an arbitrary physical memory address. This condition is commonly referred to as a write-what-where primitive and is one of the most powerful kernel exploitation primitives available. Because the driver runs in ring 0, any write reaches memory regions that are otherwise protected from user-mode code. Attackers typically abuse such primitives to overwrite kernel data structures, disable security callbacks, or elevate the calling process token to SYSTEM.

Root Cause

The root cause is missing bounds and target validation on the PhysicalAddress parameter processed by the IOCTL handler. The driver trusts user-supplied pointers and length values without confirming they reference memory the caller is authorized to modify. This is a classic exposed dangerous method pattern in Windows kernel drivers that expose direct physical memory access to unprivileged callers.

Attack Vector

Exploitation requires local access and low privileges on the target system. An authenticated user opens a handle to the driver device object and issues a DeviceIoControl call carrying the crafted PhysicalAddress and payload. No user interaction is required. Because public exploit information is available, attackers can integrate this primitive into post-exploitation tooling to escalate from a foothold to SYSTEM, disable endpoint protection callbacks, or install kernel rootkits.

No verified proof-of-concept code is reproduced here. Refer to the VulDB entry for CVE-2026-94129 for additional technical detail.

Detection Methods for CVE-2026-94129

Indicators of Compromise

Unexpected user-mode processes opening handles to the BS_RVSIO64 device object
DeviceIoControl calls targeting the vulnerable IOCTL from non-BioStar processes
Sudden token elevation of a low-privilege process to SYSTEM without a corresponding logon event
Loading or persistence of unsigned kernel modules following BioStar driver interaction

Detection Strategies

Inventory endpoints for the presence and version of BS_RVSIO64.sys matching 2.10.2411.0800
Alert on non-BioStar binaries invoking CreateFile against the driver's device path followed by DeviceIoControl
Correlate driver access events with subsequent process privilege changes to detect exploitation chains
Apply Microsoft's Vulnerable Driver Blocklist policy and monitor for attempts to load blocklisted drivers

Monitoring Recommendations

Enable kernel driver load auditing through Windows Event ID 6 in the Sysmon channel
Monitor Event ID 4688 for suspicious child processes spawned after BioStar driver interactions
Forward driver load and IOCTL telemetry to a centralized data lake for retrospective threat hunting
Baseline expected BioStar service accounts and alert on driver access from other security contexts

How to Mitigate CVE-2026-94129

Immediate Actions Required

Identify all hosts running BioStar VALKYRIE AURORA 2.10.2411.0800 and treat them as elevated-risk assets
Restrict local logon and interactive access to systems where the vulnerable driver is installed
Uninstall or disable the BioStar VALKYRIE AURORA software on hosts where it is not operationally required
Enable Microsoft's Vulnerable Driver Blocklist and Hypervisor-Protected Code Integrity (HVCI) where supported

Patch Information

No vendor patch is currently available. According to the CVE description, the vendor was contacted before disclosure but did not respond. Organizations should monitor the VulDB advisory for CVE-2026-94129 and the vendor's support channels for future updates.

Workarounds

Remove the BS_RVSIO64.sys driver from systems that do not require BioStar VALKYRIE AURORA functionality
Deploy a Windows Defender Application Control (WDAC) policy that blocks loading of BS_RVSIO64.sys by hash
Enforce least privilege so that untrusted users cannot obtain local sessions on affected hosts
Segment BioStar management workstations from general-purpose user endpoints to limit lateral exploitation

bash

# Example: Block the vulnerable driver via Windows Defender Application Control
# Generate a deny rule for BS_RVSIO64.sys and merge into an active WDAC policy
New-CIPolicyRule -DriverFilePath "C:\Windows\System32\drivers\BS_RVSIO64.sys" -Level FileHash -Deny |
  Out-File -FilePath .\DenyBioStarDriver.xml
Merge-CIPolicy -PolicyPaths .\ActivePolicy.xml,.\DenyBioStarDriver.xml -OutputFilePath .\MergedPolicy.xml
ConvertFrom-CIPolicy -XmlFilePath .\MergedPolicy.xml -BinaryFilePath .\MergedPolicy.cip