CVE-2026-94129 in VALKYRIE AURORA
Summary
by MITRE • 09/21/2026
A vulnerability was detected in BioStar VALKYRIE AURORA 2.10.2411.0800. This vulnerability affects the function sub_1105C of the file BS_RVSIO64.sys of the component IOCTL Handler. The manipulation of the argument PhysicalAddress results in write-what-where condition. The attack needs to be approached locally. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability identified within BioStar VALKYRIE AURORA version 2.10.2411.0800 represents a critical security flaw located in the kernel-mode driver BS_RVSIO64.sys, specifically affecting the IOCTL Handler component and its internal function sub_1105C. This issue stems from an improper validation of input arguments passed to the system call handler, resulting in a write-what-where condition when manipulating the PhysicalAddress parameter. In operating systems such as Windows, kernel-mode drivers operate with high privileges and direct access to physical memory addresses. When a driver fails to adequately sanitize or validate user-supplied data before using it for memory operations, it creates an avenue for attackers to overwrite arbitrary locations in kernel space. This specific flaw allows an attacker who can trigger the vulnerable IOCTL handler to write arbitrary values to any accessible physical address, effectively bypassing standard memory protection mechanisms like Data Execution Prevention and Address Space Layout Randomization at the driver level.
The operational impact of this vulnerability is severe due to its potential for privilege escalation. Since the exploit requires local access, an attacker must first gain a foothold on the target system, typically through phishing, malware installation, or physical access. However, once local execution is achieved, the write-what-where capability allows the attacker to modify critical kernel structures, such as token manipulation targets or function pointers in system tables. This can lead to complete compromise of the operating system's integrity and confidentiality. The fact that an exploit for this vulnerability is already public significantly lowers the barrier to entry for malicious actors, enabling widespread automated attacks against unpatched systems. Furthermore, the lack of response from BioStar regarding early disclosure indicates a potential gap in their security incident response process, leaving users exposed during the window between discovery and any eventual patch release.
From a classification perspective, this vulnerability aligns with CWE-787: Out-of-bounds Write, as it involves writing to memory locations outside the intended buffer or without proper bounds checking on the physical address parameter. It also relates closely to CWE-20: Improper Input Validation, which is the root cause allowing malicious data to influence control flow and memory operations. In terms of offensive security frameworks, this vulnerability facilitates techniques associated with MITRE ATT&CK T1055: Process Injection or more specifically T1068: Exploitation for Privilege Escalation, as it enables an attacker to elevate privileges from a standard user account to SYSTEM level by manipulating kernel memory. The exploitation of such driver vulnerabilities is a common tactic in advanced persistent threat campaigns targeting high-value environments where initial access has been established but further lateral movement or persistence requires higher-level permissions.
Mitigation strategies for this vulnerability are primarily focused on patching and configuration hardening since no vendor response has been received to provide an official fix immediately. Organizations should prioritize applying any available updates from BioStar as soon as they become public, ensuring that the BS_RVSIO64.sys driver is updated to a version where input validation for PhysicalAddress in sub_1105C has been corrected. In the interim, administrators can implement mitigations by restricting local user privileges and enforcing strict application whitelisting policies to prevent unauthorized execution of code that could trigger the vulnerable IOCTL handler. Additionally, enabling kernel patch protection mechanisms such as PatchGuard on Windows systems may help mitigate some forms of memory corruption, although determined attackers with write-what-where capabilities often have methods to bypass these protections. Network segmentation and monitoring for unusual driver load events or suspicious system calls can also aid in detecting exploitation attempts before full compromise occurs.