CVE-2026-84854

The WibuKey DRM/licensing kernel driver for Windows (below version 6.72) performs insufficient validation of user-supplied input when calculating the size of a kernel buffer, resulting in a small out-of-bounds write (CWE-787) past the buffer's end. A local attacker with only low-privilege access can trigger the flaw by sending crafted requests to the driver, most reliably causing a system crash (BSOD), and under unfavorable circumstances modifying adjacent kernel memory, which could enable privilege escalation to kernel/SYSTEM level (CVSS 7.0, AV:L/AC:H/PR:L). Affected systems are Windows workstations and servers that have the WibuKey driver installed, typically bundled with third-party copy-protected software such as CAD/CAM, industrial, and design applications that use WibuKey dongle licensing. Because exploitation requires local access and has high attack complexity, it is primarily a local privilege-escalation and denial-of-service risk on multi-user or malware-compromised machines. There is no public proof of concept, the CVE is not in the CISA KEV catalog, and no exploitation has been reported.

What to do: Update the WibuKey driver to version 6.72 or later, which WIBU-SYSTEMS distributes to software vendors and via its support channels. Inventory Windows machines running WibuKey-protected applications, check the file version of WibuKey.sys, and remove or replace the driver (e.g., migrate to CodeMeter) where WibuKey licensing is no longer needed. Since exploitation requires local low-privilege code execution, restrict untrusted local users and software on systems where the vulnerable driver must remain.