What’s Vulnerable › Vulnerabilities

CVE-2024-26507

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-06-10 · updated 2026-10-09
• Weakness: CWE-1286

Description

An issue in FinalWire AIRDA Extreme, AIDA64 Engineer, AIDA64 Business, AIDA64 Network Audit through 7.00.6742 allows a local attacker to escalate privileges via the DeviceIoControl call associated with MmMapIoSpace, IoAllocateMdl, MmBuildMdlForNonPagedPool, or MmMapLockedPages components.

Affected products

• FinalWire Aida64 Business: through 7.00.6700
• FinalWire Aida64 Engineer: through 7.00.6700
• FinalWire Aida64 Network Audit: through 7.00.6700
• FinalWire Airda Extreme: through 7.00.6700

References

• https://belong2yourself.github.io/vulnerabilities/docs/AIDA/Elevation-of-Privileges/readme/
• https://github.com/PaulDotSH/vuln-driver-aida64
• https://github.com/klezVirus/AIDA64DRIVER-EoP
• https://github.com/magicsword-io/LOLDrivers/issues/461
• https://www.loldrivers.io/drivers/deffeb8d-c7d9-46b9-a921-7d8d096460ef/
• https://belong2yourself.github.io/vulnerabilities/docs/AIDA/Elevation-of-Privileges/readme/

Get alerted when CVE-2024-26507 or the next vulnerability affects your stack