Local Privilege Escalation in BioStar Temperature Monitor Utility

CVE-2026-94142 is a security vulnerability residing in the BioStar Temperature Monitor Utility version 1.2.1806.2200. The vulnerability is located within the IOCTL handler of the BS_HWMIO64_W10.sys driver, specifically in the sub_1105C function. An attacker with local access to the system can exploit improper validation of the PhysicalAddress argument to perform a write-what-where operation. This manipulation allows for kernel memory corruption and potentially leads to the execution of arbitrary code with SYSTEM or kernel-level privileges. Public exploit code for this vulnerability has been disclosed, increasing the risk of exploitation by local attackers seeking to elevate privileges. BioStar did not respond to initial disclosure attempts, and no vendor patch is currently available.

Impact

Successful exploitation of this vulnerability allows a local user to escalate privileges to the kernel or SYSTEM level. This enables the attacker to bypass operating system security controls, install persistent backdoors, dump sensitive kernel memory, or disable endpoint protection software. The vulnerability affects environments where the BioStar Temperature Monitor Utility is installed on Windows systems.

Recommendation

Prioritize the identification and removal of vulnerable versions of the BioStar Temperature Monitor Utility (version 1.2.1806.2200) from all endpoints. Monitor system event logs for unusual driver loading activities or unexpected process executions occurring from user-space applications that interact with hardware monitoring interfaces. If the utility is not business-critical, implement a policy to block or uninstall the affected driver BS_HWMIO64_W10.sys.