Local Privilege Escalation in BioStar VALKYRIE AURORA Driver

CVE-2026-94129 describes a high-severity security vulnerability in the BioStar VALKYRIE AURORA software version 2.10.2411.0800. The flaw resides within the driver file BS_RVSIO64.sys, specifically impacting the IOCTL handler function sub_1105C. An attacker with local access to the system can manipulate the PhysicalAddress argument, resulting in a write-what-where vulnerability. This condition allows an adversary to perform arbitrary memory writes, potentially leading to local privilege escalation or system compromise. Publicly available exploit code exists for this vulnerability, and the vendor has not responded to disclosure attempts. Because the attack requires local access, this represents a significant risk for systems where untrusted users or applications may interact with the driver interface.

Impact

Successful exploitation allows a local user to execute arbitrary code with elevated privileges, potentially leading to a full system compromise. The vulnerability affects users of the BioStar VALKYRIE AURORA software version 2.10.2411.0800 on Windows operating systems. If exploited, an attacker could bypass OS security controls to install persistent backdoors, access sensitive data, or disable security software.

Recommendation

• Monitor system logs for unauthorized access to device drivers or attempts to interact with the BS_RVSIO64.sys interface.
• Audit systems for the presence of BioStar VALKYRIE AURORA version 2.10.2411.0800 and consider restricting access to the executable or driver files until a vendor security update is available.
• Implement endpoint security controls to restrict execution of untrusted binaries that might attempt to interact with IOCTLs of kernel-mode drivers.