CVE-2026-94146: BioStar BIOS Update Utility IOCTL BSMEM64_W10.sys sub_110BC write-what-where

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-21 · updated 2026-09-22
Weakness: CWE-119

Description

A vulnerability was found in BioStar BIOS Update Utility 1.9.7.3. This issue affects the function sub_110BC of the file BSMEM64_W10.sys of the component IOCTL Handler. The manipulation of the argument PhysicalAddress/Size results in write-what-where condition. Attacking locally is a requirement. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

BioStar BIOS Update Utility: 1.9.7.3

References

https://vuldb.com/cve/CVE-2026-94146
https://vuldb.com/submit/894066
https://vuldb.com/vuln/408061
https://vuldb.com/vuln/408061/cti

Get alerted when CVE-2026-94146 or the next vulnerability affects your stack