CVE-2026-94142 in Temperature Monitor Utility
Summary
by MITRE • 09/21/2026
A security vulnerability has been detected in BioStar Temperature Monitor Utility 1.2.1806.2200. Affected by this vulnerability is the function sub_1105C of the file BS_HWMIO64_W10.sys of the component IOCTL Handler. Such manipulation of the argument PhysicalAddress leads to write-what-where condition. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/21/2026
The BioStar Temperature Monitor Utility version 1.2.1806.2200 contains a critical security flaw within its kernel-mode driver, specifically identified as BS_HWMIO64_W10.sys. This vulnerability resides in the IOCTL handler component and is triggered through the function sub_1105C. The core technical issue involves improper validation of input arguments passed to this routine, particularly concerning the PhysicalAddress parameter. When an attacker provides a manipulated value for this argument, the driver fails to verify whether the address falls within valid memory boundaries or if it has appropriate access permissions before proceeding with the write operation. This lack of rigorous bounds checking and privilege verification results in a classic write-what-where condition, allowing arbitrary data to be written to any physical memory location accessible by the system.
This type of vulnerability is formally classified under CWE-787: Out-of-bounds Write, which describes situations where software writes data beyond the intended buffer or memory region due to insufficient boundary checks. In the context of kernel-mode drivers, such flaws are particularly severe because they bypass user-space protections and operate with high system privileges. The ability to write arbitrary values to arbitrary physical addresses effectively grants an attacker full control over the operating system's memory state. This can be leveraged to overwrite critical data structures, modify code execution paths, or escalate privileges from a standard user account to that of SYSTEM or kernel-level access.
From an operational perspective, this vulnerability requires local access for exploitation, meaning an attacker must already have some level of authenticated interaction with the target machine. However, once local access is established, the impact is catastrophic. The exploit has been disclosed publicly and is known to be functional, which significantly lowers the barrier to entry for malicious actors. An adversary could use this flaw to disable security software, inject malware directly into kernel memory, extract sensitive information such as encryption keys or passwords stored in physical memory, or achieve complete system compromise. The fact that the vendor was contacted early regarding this disclosure but failed to respond indicates a lack of active maintenance and support for this specific version of the utility, leaving users exposed without official patches or mitigations provided by the manufacturer.
To mitigate the risks associated with this vulnerability, organizations should immediately assess their environment for instances of BioStar Temperature Monitor Utility 1.2.1806.2200. Given that no patch is available from the vendor due to non-response, the most effective mitigation strategy involves removing or disabling the affected driver if it is not strictly necessary for operations. If the utility must remain in use, implementing strict application control policies via Windows Defender Application Control or similar endpoint protection solutions can prevent the loading of unsigned or unauthorized kernel drivers. Additionally, ensuring that only authorized users have local administrative privileges reduces the attack surface by limiting who can potentially trigger IOCTL calls to this vulnerable driver. Regular auditing of installed software and keeping systems updated with the latest security patches from other vendors is also recommended to maintain a robust defense posture against known exploits.