CVE-2026-81579
Received Received - Intake

Untrusted Pointer Dereference in WibuKey Windows Driver

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: 2fc02b1f-71e7-4514-a878-169626f68903

Description
In WibuKey for Windows before version 6.71, an untrusted pointer dereference in the WibuKey2_64.sys kernel driver for 64-bit Windows allows an attacker to exploit a write-what-where primitive, enabling local privilege escalation. This can be leveraged to execute arbitrary code, run an administrator shell, or gain full control over the system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-81579
EUVD
EUVD-2026-66984

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wibu-systems wibukey to 6.71 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-123 Any condition where the attacker has the ability to write an arbitrary value to an arbitrary location, often as the result of a buffer overflow.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a privilege escalation vulnerability in WibuKey for Windows before version 6.71. It involves an untrusted pointer dereference in the WibuKey2_64.sys kernel driver that allows local attackers to exploit a write-what-where primitive. This can lead to arbitrary code execution, running an administrator shell, or gaining full system control.

Detection Guidance

To detect this vulnerability, check the installed version of WibuKey for Windows. Compare it against version 6.71. If the version is older, the system is vulnerable. Look for the presence of the WibuKey2_64.sys driver in the system's drivers directory.

Impact Analysis

If exploited, this vulnerability allows an attacker with local access to execute arbitrary code, run an administrator shell, or gain full control over the affected system. This could result in unauthorized data access, system damage, or further network compromise.

Compliance Impact

This vulnerability allows local attackers to gain full system control through privilege escalation, which could lead to unauthorized access to sensitive data. Such access may violate compliance requirements under GDPR (data protection) and HIPAA (health information security) by exposing personal or protected health information.

Mitigation Strategies

Immediately update WibuKey to version 6.71 or later. If the system uses WibuKey exclusively as a network client, remove the vulnerable WibuKey USB driver as a temporary mitigation. Ensure no untrusted local access is permitted until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81579. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart