Driver intelligenceVulnerableVerified

CmUpx.sys

CmUpx.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / 64601d77-61ea-43b7-8178-9d45dfba6022ADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

CmUpx.sysSample 1 · HVCI FALSE

MD5: 0463f185ac41aa492bd35dceb5de2ffc
SHA1: 0e03d54a6fb230f54127363013770468dd156ba4
SHA256: cdf38928a13dfe0e6de054f0229945b9f7db9f88eb7269ecefdceb4b5fab4bfa
Imphash: ab986ade8b3cc340f30c1f64554034d7
Authentihash MD5: d30f54980f19a18359999c0cb4195ad8
Authentihash SHA1: d27a90e89b920c9553770d6d218e1d36a0381271
Authentihash SHA256: 0dbd363c5cf7878d2b375554fb23b4986cc1e40baed15255ce5336618c70a8e7
Machine: AMD64
Version: 1.13.0.0
Publisher: Realtek Semiconductor Corp.

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create CmUpx binPath=C:\windows\temp\CmUpx.sys type=kernel && sc.exe start CmUpx

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint