Local Privilege Escalation in BioStar BIOS Update Utility

A high-severity vulnerability (CVE-2026-94146) has been identified in the BioStar BIOS Update Utility version 1.9.7.3. The flaw exists within the BSMEM64_W10.sys driver, specifically in the IOCTL handler function sub_110BC. By manipulating the PhysicalAddress and Size arguments sent to the driver, a local attacker can trigger a write-what-where condition. This vulnerability enables a local user with standard privileges to escalate their permissions, potentially leading to full system compromise. Because the utility is intended to modify system firmware settings, the driver likely operates with elevated kernel-level privileges. Public exploit code for this vulnerability is currently available, and the vendor has not provided a patch or a response to the disclosure. Defenders should identify systems running this utility and consider removing it if not required for essential BIOS maintenance.

Impact

Successful exploitation of this vulnerability allows an attacker who already has local access to a system to elevate privileges, potentially gaining SYSTEM-level access. This poses a significant threat to internal security, as it allows attackers to bypass OS-level access controls, deploy persistence mechanisms, or extract sensitive data protected by kernel-level security features. The utility is primarily used on Windows 10 systems utilizing BioStar hardware.

Recommendation

Prioritize the identification of endpoints running BioStar BIOS Update Utility version 1.9.7.3. Given the lack of a vendor patch and the existence of public exploit code, consider the following actions:

• Uninstall BioStar BIOS Update Utility 1.9.7.3 from all managed Windows 10 workstations.
• Monitor for unauthorized loading of the BSMEM64_W10.sys driver or unusual IOCTL communication to this driver if it must remain installed for critical operations.
• Block the execution of known proof-of-concept tools targeting CVE-2026-94146 using Endpoint Detection and Response (EDR) blocklists.