{"id":"CVE-2026-94146","published":"2026-09-21T07:16:53.993","lastModified":"2026-09-21T13:33:33.387","description":"A vulnerability was found in BioStar BIOS Update Utility 1.9.7.3. This issue affects the function sub_110BC of the file BSMEM64_W10.sys of the component IOCTL Handler. The manipulation of the argument PhysicalAddress/Size results in write-what-where condition. Attacking locally is a requirement. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-119","CWE-123"],"vendors":[],"products":[],"references":[{"url":"https://vuldb.com/cve/CVE-2026-94146","tags":[]},{"url":"https://vuldb.com/submit/894066","tags":[]},{"url":"https://vuldb.com/vuln/408061","tags":[]},{"url":"https://vuldb.com/vuln/408061/cti","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows write-what-where conditions through manipulation of PhysicalAddress/Size arguments in BioStar BIOS Update Utility 1.9.7.3, enabling local attackers to exploit it.","exploitability":"Exploitation requires local access and knowledge of the vulnerability; public exploits exist but are not widely known.","blast_radius":"If exploited, this could lead to full system compromise as local attackers can manipulate critical BIOS functions.","remediation":"Update to the latest version of BioStar BIOS Update Utility or apply vendor patches immediately.","tags":["local-privilege-escalation","bios","utility","patch-recommended"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-22T06:03:28.313Z"}}