Vulnerability · Published Sep 21, 2026 · Assigned by VulDB
CVE-2026-94146BioStar BIOS Update Utility IOCTL BSMEM64_W10.sys sub_110BC write-what-where
High 8.8
In plain English
A high-severity memory corruption in BIOS Update Utility from BioStar. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).
Official description
A vulnerability was found in BioStar BIOS Update Utility 1.9.7.3. This issue affects the function sub_110BC of the file BSMEM64_W10.sys of the component IOCTL Handler. The manipulation of the argument PhysicalAddress/Size results in write-what-where condition. Attacking locally is a requirement. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| BioStar | BIOS Update Utility | 1.9.7.3 |
Weakness: CWE-123, CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R
References
- VDB-408061 | BioStar BIOS Update Utility IOCTL BSMEM64_W10.sys sub_110BC write-what-where vdb-entry, technical-description
- VDB-408061 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- CVE-2026-94146 | CVE Analysis and Report third-party-advisory
- Submit #894066 | BIOSTAR Group BIOS Update Utility 1.9.7.3 Arbitrary Kernel Memory Read/Write third-party-advisory