CVE-2026-94142: BioStar Temperature Monitor Privilege Escalation

CVE-2026-94142 Overview

CVE-2026-94142 is a write-what-where vulnerability in the BioStar Temperature Monitor Utility version 1.2.1806.2200. The flaw resides in the sub_1105C function within the BS_HWMIO64_W10.sys kernel driver, specifically inside its IOCTL handler. An authenticated local attacker can manipulate the PhysicalAddress argument to write attacker-controlled data to arbitrary physical memory locations. Successful exploitation enables kernel-level code execution and full system compromise. The exploit has been publicly disclosed, and the vendor did not respond to disclosure attempts, leaving affected deployments without an official patch.

Critical Impact
A local, low-privileged user can achieve SYSTEM/kernel-level privileges by issuing crafted IOCTLs to the vulnerable signed driver, undermining confidentiality, integrity, and availability of the host.

Affected Products

BioStar Temperature Monitor Utility 1.2.1806.2200
Component: BS_HWMIO64_W10.sys IOCTL handler
Vulnerable function: sub_1105C

Discovery Timeline

2026-09-21 - CVE-2026-94142 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-94142

Vulnerability Analysis

The vulnerability is a write-what-where condition classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer). The BS_HWMIO64_W10.sys driver exposes an IOCTL interface reachable from user mode. Inside the sub_1105C routine, the driver accepts a PhysicalAddress value supplied by the caller and performs a write operation against it without validating the target address or the caller's privilege context.

Because the driver executes in kernel mode (Ring 0), any write it performs bypasses standard user-mode memory protections. An attacker can therefore corrupt kernel structures, overwrite security tokens, or patch code pages to escalate to SYSTEM. This class of hardware I/O driver exposure has been repeatedly abused as a Bring Your Own Vulnerable Driver (BYOVD) primitive.

Root Cause

The root cause is missing validation of user-supplied input reaching a privileged memory-write primitive. The IOCTL handler trusts the PhysicalAddress parameter and neither restricts the caller nor constrains the target range. This creates an arbitrary physical memory write reachable by any local process able to open a handle to the driver's device object.

Attack Vector

Exploitation requires local access with low privileges. The attacker opens the driver's device object using CreateFile, then issues DeviceIoControl with the vulnerable IOCTL code and a crafted input buffer containing the target PhysicalAddress and the value to write. Refer to the VulDB entry for CVE-2026-94142 for the disclosed technical write-up and proof-of-concept details.

No verified exploit code is republished here. The vulnerability mechanism is a classic IOCTL-driven arbitrary write against physical memory, which typical exploitation chains use to map kernel structures and elevate the current process token.

Detection Methods for CVE-2026-94142

Indicators of Compromise

Presence of BS_HWMIO64_W10.sys on hosts that do not require the BioStar Temperature Monitor Utility.
Non-BioStar processes opening handles to the driver's device object or issuing DeviceIoControl calls to it.
Unexpected kernel-mode writes, SYSTEM token duplication events, or new SYSTEM-level child processes spawned from low-privileged user sessions.

Detection Strategies

Hunt for load events of BS_HWMIO64_W10.sys using Windows Event ID 6 (Sysmon driver load) or EDR driver-load telemetry, and alert on loads outside expected BioStar installation paths.
Correlate device-object opens (\\.\ handles associated with the driver) with subsequent privilege escalation indicators such as token manipulation or process integrity changes.
Apply Microsoft's Vulnerable Driver Blocklist and enable Hypervisor-Protected Code Integrity (HVCI) to block loads of the driver where feasible.

Monitoring Recommendations

Inventory all endpoints running BioStar Temperature Monitor Utility 1.2.1806.2200 and flag the driver hash for continuous monitoring.
Alert on any local process invoking DeviceIoControl against the driver from non-standard binaries or interactive user sessions.
Monitor for lateral movement or persistence activity following alerts on the driver, since kernel compromise typically precedes broader intrusion activity.

How to Mitigate CVE-2026-94142

Immediate Actions Required

Uninstall the BioStar Temperature Monitor Utility on systems where it is not operationally required.
Remove or rename BS_HWMIO64_W10.sys where the application is not in use, and revoke the driver's service registration.
Add the driver's hash to the Microsoft Vulnerable Driver Blocklist and enforce Windows Defender Application Control (WDAC) policies to prevent loading.
Restrict local logon rights and enforce least privilege to reduce the pool of accounts capable of triggering the IOCTL.

Patch Information

No vendor patch is available. According to the disclosure, the vendor was contacted but did not respond. Organizations should treat the driver as unpatched and rely on compensating controls. Track the VulDB vulnerability record #408057 for updates on any future vendor response.

Workarounds

Enable HVCI and Memory Integrity in Windows Security to block unsigned or blocklisted kernel drivers from loading.
Deploy WDAC or AppLocker policies that explicitly deny the BS_HWMIO64_W10.sys driver hash.
Segment and monitor hosts still requiring the utility, limiting them to dedicated administrative workstations.
Disable the driver's service entry so it does not start at boot on systems where removal is not immediately possible.

bash

# Example: Disable and remove the vulnerable driver service on Windows
sc.exe query BS_HWMIO64_W10
sc.exe stop  BS_HWMIO64_W10
sc.exe delete BS_HWMIO64_W10

# Verify the driver file is no longer present in the driver store
dir C:\Windows\System32\drivers\BS_HWMIO64_W10.sys