{"id":"CVE-2026-94146","published":"2026-09-21T07:16:53.993","lastModified":"2026-09-22T16:18:17.603","description":"A vulnerability was found in BioStar BIOS Update Utility 1.9.7.3. This issue affects the function sub_110BC of the file BSMEM64_W10.sys of the component IOCTL Handler. The manipulation of the argument PhysicalAddress/Size results in write-what-where condition. Attacking locally is a requirement. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-119","CWE-123"],"vendors":[],"products":[],"references":[{"url":"https://vuldb.com/cve/CVE-2026-94146","tags":[]},{"url":"https://vuldb.com/submit/894066","tags":[]},{"url":"https://vuldb.com/vuln/408061","tags":[]},{"url":"https://vuldb.com/vuln/408061/cti","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows an attacker to manipulate the PhysicalAddress/Size argument, leading to a write-what-where condition, which can be exploited locally to gain unauthorized access or control.","exploitability":"Exploitation requires local access and manipulation of the PhysicalAddress/Size argument, making it moderately difficult.","blast_radius":"If exploited, the vulnerability could result in unauthorized access or control of the system, potentially leading to data theft or system compromise.","remediation":"Upgrade to BioStar BIOS Update Utility 1.9.7.4 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["local-privilege-escalation","write-what-where","bios-update"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-29T09:18:21.479Z"}}