Arbitrary Memory Write Vulnerability in BioStar VIVID LED DJ Driver

A critical security vulnerability has been identified in the BioStar VIVID LED DJ driver version 4.0.2411.1500. The flaw resides within the IOCTL handler function, specifically sub_1105C, located in the BS_LED64.sys kernel-mode driver. The vulnerability stems from improper handling of the AssociatedIrp argument, which permits an attacker with local access to the system to trigger a write-what-where condition. By crafting a specific IOCTL request, an unprivileged user can overwrite arbitrary kernel memory. This capability is a significant security concern as it can be leveraged to bypass Windows security controls, disable kernel-mode protections, or facilitate full system privilege escalation. Public exploit material exists for this vulnerability, and the vendor has not provided a response or a patch to address the issue. Defenders should prioritize monitoring for the loading of this specific driver or identifying local processes attempting unauthorized IOCTL communication with it.

Impact

Successful exploitation of CVE-2026-94128 requires local system access. If exploited, an attacker can transition from a low-privilege user context to SYSTEM-level privileges. This facilitates persistence, evasion of endpoint security solutions, and potential full system compromise. Given the nature of kernel-mode vulnerabilities, the impact is severe, potentially resulting in complete loss of system integrity and confidentiality.

Recommendation

• Monitor for the installation or presence of the BioStar VIVID LED DJ driver BS_LED64.sys on high-security or critical infrastructure assets.
• Implement strict application control policies to prevent the execution of untrusted binaries that may attempt to interact with the vulnerable IOCTL handler.
• Audit system configurations for the use of legacy or non-essential hardware drivers.
• Due to the lack of a vendor patch, isolate systems running the vulnerable driver version (4.0.2411.1500) from untrusted user access if possible.