Driver intelligenceVulnerableVerified

wdisvhost.sys

wdisvhost.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / 894bd2db-1d93-4b3d-8e4d-7dac29382cb9ADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

wdisvhost.sysSample 1 · HVCI FALSE

MD5: 9851c3d7aee98aa0d712c50e9ca20eb9
SHA1: 513e8fc423ce2737843053852a0a672c43d2db9e
SHA256: 988960e31a258ea71cf93a7791ae8c91c8cefb6ad8a50cdbd1b07f73b524aa61
Imphash: 8e01c1742ba7ebcbb0d61dd1ca8a6e91
Authentihash MD5: a7c7afe04a23793de0fe3b0d99cc20bd
Authentihash SHA1: ce465a42be6f19ca8e99c23b78c42b6073c8b673
Authentihash SHA256: 5721c075bfec3ce946b8a96a58551a765be294212eaf27e5ffd6b738baef57d3
Machine: AMD64
Version: Not recorded
Publisher: Not recorded

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create wdisvhost binPath=C:\windows\temp\wdisvhost.sys type=kernel && sc.exe start wdisvhost

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint