CVE-2026-94128 in VIVID LED DJ
Summary
by MITRE • 09/21/2026
A security vulnerability has been detected in BioStar VIVID LED DJ 4.0.2411.1500. This affects the function sub_1105C of the file BS_LED64.sys of the component IOCTL Handler. The manipulation of the argument AssociatedIrp leads to write-what-where condition. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/21/2026
The BioStar VIVID LED DJ software, specifically version 4.0.2411.1500, contains a critical security flaw within its kernel-mode driver component BS_LED64.sys. This vulnerability resides in the IOCTL handler subsystem, which is responsible for processing input/output control codes sent from user-space applications to the operating system's kernel. The specific point of failure occurs at memory address sub_1105C, where the function fails to adequately validate or sanitize arguments passed via the AssociatedIrp structure within the IRP (I/O Request Packet). This structural oversight allows an attacker with local access to manipulate these arguments in a manner that results in a write-what-where condition. A write-what-where vulnerability is among the most severe classes of memory corruption flaws, as it permits arbitrary modification of kernel memory contents at any specified virtual address, effectively bypassing standard operating system security boundaries and data execution protections.
From a technical perspective, this flaw aligns with CWE-787: Out-of-bounds Write, although its impact extends far beyond simple buffer overflows due to the precise control it offers over write targets. In the context of Windows kernel drivers, improper handling of IRP parameters often leads to privilege escalation because the driver operates at Ring 0, the highest level of system privileges. By exploiting this flaw, a local attacker can overwrite critical kernel data structures such as access tokens or function pointers within the System process. This capability directly maps to MITRE ATT&CK technique T1068: Exploitation for Privilege Escalation, specifically through driver exploitation methods. The ability to write arbitrary values to arbitrary memory locations allows an adversary to hijack execution flow or elevate their current user context to that of SYSTEM, thereby gaining complete control over the affected host machine.
The operational impact of this vulnerability is severe due to its local nature and public availability. Although local access is required to initiate the attack, many scenarios such as shared workstations, remote desktop sessions, or compromised low-privilege accounts provide sufficient entry points for exploitation. The fact that the exploit has been disclosed publicly significantly lowers the barrier to entry for malicious actors, enabling automated attacks against unpatched systems. Furthermore, the vendor's lack of response to early disclosure attempts indicates a potential gap in their security patching lifecycle and vulnerability management processes. This absence of an official fix leaves users exposed indefinitely unless they implement manual workarounds or rely on third-party mitigation strategies. The persistence of this flaw highlights risks associated with legacy hardware drivers that may not receive regular security updates, creating long-term attack surfaces within enterprise environments.
Mitigation for this issue requires immediate attention given the severity and public exploit availability. Since no official patch has been released by BioStar, administrators should consider disabling or uninstalling the BS_LED64.sys driver if it is not strictly necessary for core operations. If the hardware functionality provided by the LED DJ system is essential, users must ensure that local access to the machine is tightly controlled and restricted to trusted personnel only. Implementing application whitelisting policies can prevent unauthorized execution of exploit code targeting this vulnerability. Additionally, enabling Kernel Patch Protection (PatchGuard) on 64-bit Windows systems may provide some resistance against certain types of kernel memory corruption, although it does not guarantee protection against all write-what-where exploits. Organizations should also monitor for indicators of compromise related to driver loading and privilege escalation attempts using endpoint detection and response tools configured to flag suspicious IRP handling anomalies or unexpected changes in system token privileges.