CVE-2026-84854: Out of Bound Write on WibuKey for Windows

Severity: high (CVSS 7.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-06 · updated 2026-10-15
Weakness: CWE-787

Description

In the WibuKey driver for Windows below Version 6.72, insufficient validation of user input when calculating the size of a kernel buffer could cause small amounts of data to be written outside the intended kernel buffer. This can lead to a system crash. Under unfavorable circumstances, adjacent kernel memory may be modified.

Affected products

wibu-systems-ag wibukey: before 6.72 — fixed in 6.72

How to fix

Upgrade to a fixed version: wibu-systems-ag wibukey 6.72. Check the vendor advisory for mitigations.

References

https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-100065.pdf
https://cert-portal.siemens.com/productcert/html/ssa-148322.html

Get alerted when CVE-2026-84854 or the next vulnerability affects your stack