CVE-2026-94146: BioStar BIOS Utility Use-After-Free Flaw

CVE-2026-94146 Overview

CVE-2026-94146 is a local privilege escalation vulnerability in the BioStar BIOS Update Utility version 1.9.7.3. The flaw exists in the sub_110BC function of the BSMEM64_W10.sys driver, specifically within its IOCTL handler. Attackers who control the PhysicalAddress and Size arguments passed to the driver can trigger a write-what-where primitive. This primitive allows arbitrary kernel memory writes at attacker-chosen addresses. The exploit technique has been made public. The vendor was contacted before disclosure but did not respond, leaving no coordinated patch available at publication time.

Critical Impact
Local attackers with low privileges can achieve arbitrary kernel memory writes through the vulnerable IOCTL, enabling full system compromise and SYSTEM-level code execution.

Affected Products

BioStar BIOS Update Utility 1.9.7.3
Component: BSMEM64_W10.sys driver
Vulnerable function: sub_110BC (IOCTL Handler)

Discovery Timeline

2026-09-21 - CVE-2026-94146 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-94146

Vulnerability Analysis

The vulnerability resides in the IOCTL handler routine sub_110BC inside BSMEM64_W10.sys, a signed kernel driver bundled with the BioStar BIOS Update Utility. The driver exposes an IOCTL that accepts a physical memory address and a size argument from user mode. The handler passes these values directly to a kernel write operation without validating whether the caller should be permitted to target that address. This produces a classic write-what-where condition [CWE-119], letting an attacker overwrite arbitrary kernel structures.

Because the driver runs at Ring 0, any local process capable of opening the driver device can escalate to SYSTEM. Common exploitation strategies include patching _EPROCESS.Token fields, corrupting kernel callback tables, or disabling security callbacks. Publicly available proof-of-concept techniques for similar vulnerable driver primitives make weaponization straightforward.

Root Cause

The root cause is missing input validation on the PhysicalAddress and Size parameters supplied through the IOCTL interface. The driver trusts user-supplied physical address values and performs a memory-mapped write without enforcing address range checks, caller privilege verification, or access control on the device object.

Attack Vector

Exploitation requires local access with low-privileged user credentials. The attacker opens a handle to the vulnerable driver's device object, then issues a crafted DeviceIoControl request containing the target kernel address in the PhysicalAddress field and a controlled payload sized by the Size field. Successful exploitation yields kernel-mode arbitrary write capability, which is trivially converted to SYSTEM privileges. Refer to the VulDB entry for CVE-2026-94146 for additional technical context.

Detection Methods for CVE-2026-94146

Indicators of Compromise

Presence of BSMEM64_W10.sys loaded on systems that do not require the BioStar BIOS Update Utility.
Unexpected CreateFile or DeviceIoControl calls targeting the BSMEM64 device object from non-installer processes.
Sudden token elevation of a previously low-privileged process to SYSTEM without a legitimate parent chain.
New services, drivers, or scheduled tasks created immediately after driver interaction.

Detection Strategies

Enable Microsoft's vulnerable driver blocklist and Hypervisor-Protected Code Integrity (HVCI) to prevent load of known-abusable signed drivers.
Hunt for process handles opened against the \\.\BSMEM64 device path outside of authorized firmware update workflows.
Correlate driver load events (Windows Event ID 6, Sysmon Event ID 6) with subsequent privilege escalation activity.
Baseline IOCTL usage patterns and alert on non-vendor executables interacting with the driver.

Monitoring Recommendations

Ingest kernel driver load telemetry into a central data lake and alert on BSMEM64_W10.sys outside sanctioned maintenance windows.
Monitor for token manipulation and process integrity level changes tied to child processes of unusual parents.
Track Endpoint Detection and Response (EDR) alerts referencing bring-your-own-vulnerable-driver (BYOVD) techniques mapped to MITRE ATT&CK T1068.

How to Mitigate CVE-2026-94146

Immediate Actions Required

Uninstall the BioStar BIOS Update Utility 1.9.7.3 from all endpoints that do not actively require it.
Delete or quarantine the BSMEM64_W10.sys driver file from disk if the utility must remain installed but is idle.
Add BSMEM64_W10.sys to the Microsoft Vulnerable Driver Blocklist or an equivalent Windows Defender Application Control (WDAC) policy.
Restrict local logon rights on sensitive systems to reduce the pool of accounts capable of triggering the IOCTL.

Patch Information

No vendor patch is available. According to the disclosure, the vendor was contacted early but did not respond. Organizations should treat the driver as unfixed and rely on driver blocklisting and removal until an updated release is confirmed. Track the VulDB vulnerability record #408061 for future updates.

Workarounds

Enable Memory Integrity (HVCI) and Smart App Control on Windows 10/11 systems to block loading of the vulnerable driver.
Deploy a WDAC or AppLocker policy that denies execution of the BioStar utility and its driver by hash.
Enforce least-privilege user access and disable interactive logon for service accounts on systems where the utility is present.
Segment BIOS management workstations from general-purpose endpoints to limit local attack surface.

bash

# Example: Add BSMEM64_W10.sys to a WDAC deny rule using PowerShell
New-CIPolicyRule -DriverFilePath 'C:\Path\To\BSMEM64_W10.sys' -Level Hash -Deny |
  Merge-CIPolicy -PolicyPaths .\BasePolicy.xml -OutputFilePath .\BlockBSMEM64.xml
ConvertFrom-CIPolicy -XmlFilePath .\BlockBSMEM64.xml -BinaryFilePath .\BlockBSMEM64.cip