BS_LED64.sys
BS_LED64.sys is the BIOSTAR I/O driver distributed with VIVID LED DJ. CVE-2026-94128 identifies vulnerable IOCTL handling in VIVID LED DJ 4.0.2411.1500. The included driver version 10.0.2410.1000 exposes physical-memory read and write operations through IOCTLs 0x226040 and 0x226044. These operations map a caller-supplied 32-bit physical starting address with MmMapIoSpace without an address allowlist. A public proof of concept embeds this exact driver sample. Exploitation requires the driver to be loaded and the caller to obtain access to its device; access from an unprivileged account has not been independently verified.
Known samples 1
0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
BS_LED64.sysSample 1 · HVCI unknown
- MD5
aeb412990d1540c294f98da981661cd2- SHA1
3303a23d4217f9712b8659fbb5f4a51817aa4b75- SHA256
db86e3e131a899e1688522d2003d22c3131f8b7cdb432b084be37078b9a3429d- Imphash
fab7775e4272ac915bfb8e21eb66ef00- Authentihash MD5
b8013586ab533221020fd85b8f6997fa- Authentihash SHA1
6bc45fc592b03614b4ac0a828f5ddecb1a31bd49- Authentihash SHA256
b3836a0167c7b84aeaa9f1c551d4e4c82aba0e79958776a7ae60ebeca67a606f- Machine
- AMD64
- Version
- 10.0.2410.1000
- Publisher
- BIOSTAR Group
Recorded command
sc.exe create BS_LED64 binPath= C:\windows\temp\BS_LED64.sys type= kernel && sc.exe start BS_LED64Read or modify physical memory through the BS_LED device, potentially compromising kernel memory and enabling local privilege escalation. · Privileges: Administrator to install or load the driver; use requires an accessible handle to the loaded driver's device. · OS: Windows
Research & references
Acknowledgement: lzty(@ice_icat)