CVE-2026-94146 in BIOS Update Utility
Summary
by MITRE • 09/21/2026
A vulnerability was found in BioStar BIOS Update Utility 1.9.7.3. This issue affects the function sub_110BC of the file BSMEM64_W10.sys of the component IOCTL Handler. The manipulation of the argument PhysicalAddress/Size results in write-what-where condition. Attacking locally is a requirement. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/21/2026
The BioStar BIOS Update Utility version 1.9.7.3 contains a critical security flaw within its kernel-mode driver component, specifically identified as BSMEM64_W10.sys. This vulnerability resides in the IOCTL handler subsystem and affects the function sub_110BC, which is responsible for processing input/output control codes issued by user-space applications to interact with hardware or system resources. The core technical deficiency lies in the improper validation of arguments passed to this routine, particularly regarding the PhysicalAddress and Size parameters. When these inputs are manipulated by a local attacker, they allow for an arbitrary memory write operation, commonly referred to as a write-what-where condition. This type of flaw is classified under CWE-787, which denotes out-of-bounds write vulnerabilities that occur when software writes data beyond the boundaries of allocated buffers or invalid memory regions due to insufficient boundary checks.
The operational impact of this vulnerability is severe because it operates at ring 0, the highest privilege level in x86 architecture where kernel-mode drivers execute. By exploiting the lack of proper validation on PhysicalAddress and Size, an attacker can overwrite arbitrary physical memory locations with controlled data. This capability effectively bypasses standard operating system security mechanisms such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR), which are designed to mitigate exploitation by randomizing code placement or preventing execution from non-executable memory pages. The ability to write anywhere in physical memory allows an attacker to modify critical kernel structures, inject malicious shellcode into legitimate processes, or alter security-critical flags that control access permissions and integrity checks. Consequently, this vulnerability serves as a potent primitive for achieving arbitrary code execution with system-level privileges.
From the perspective of threat intelligence and attack frameworks, this exploit aligns closely with MITRE ATT&CK techniques related to privilege escalation and defense evasion. Specifically, it facilitates Local Privilege Escalation (T1068) by allowing an unprivileged user to gain kernel access. Furthermore, the write-what-where mechanism can be leveraged for Defense Evasion tactics such as process injection or hooking system calls to hide malicious activity from endpoint detection and response solutions. The fact that a public exploit exists significantly lowers the barrier to entry for attackers, enabling even those with limited technical expertise to compromise systems running this specific version of the BioStar BIOS Update Utility. This widespread availability increases the risk profile considerably, as automated scanning tools may actively seek out instances of this vulnerability in targeted environments.
The local nature of the attack requires that an adversary already have some form of access to the affected system, such as a low-privilege user account or command-line interface access. However, given the severity of the resulting privilege escalation, even limited initial access can lead to complete system compromise. The vendor's failure to respond to early disclosure attempts suggests a lack of active security maintenance for this legacy utility, leaving users exposed without official patches or updates. In such scenarios where patching is not immediately available due to vendor inactivity, mitigation strategies must focus on reducing the attack surface and enforcing strict access controls.
To mitigate the risks associated with this vulnerability, organizations should prioritize removing or disabling the BioStar BIOS Update Utility if it is no longer required for hardware management tasks. If the utility remains necessary for operational purposes, administrators should enforce stringent user account control policies to prevent unauthorized users from executing the application or interacting with its driver components. Implementing application whitelisting solutions can also help restrict execution of untrusted binaries that might attempt to exploit this flaw. Additionally, deploying endpoint detection and response tools configured to monitor for unusual kernel-mode activity, such as unexpected IOCTL calls or memory modifications in sensitive regions, may provide early warning indicators of exploitation attempts. Regular audits of installed drivers and utilities are essential to ensure that outdated software with known vulnerabilities is not present on critical systems.