dc82ae79-d3e2-439a-a4c7-ec1f23e1261b

fbiosdrv.sys :inline

Description

Fujitsu BIOS Driver versions before 2.5.0.0 are affected by CVE-2025-65001. This signed 2.4.0.0 build creates the \Device\FBIOSDRV interface. A specially crafted request from a local authenticated administrator can trigger an out-of-bounds write, potentially causing arbitrary kernel code execution or a denial of service.

  • UUID: dc82ae79-d3e2-439a-a4c7-ec1f23e1261b
  • Created: 2026-08-31
  • Author: Michael Haag
  • Acknowledgement: fluffycats31 | @fluffycats31

Download

This download link contains the vulnerable driver!

Block fbiosdrv.sys across your endpoints

Add this driver to your block policy in minutes with MagicSword, threat-driven application control. Free for up to 100 endpoints.

Start Blocking for Free

Commands

sc.exe create FBIOSDRV type= kernel binPath= C:\\windows\\temp\\fbiosdrv.sys && sc.exe start FBIOSDRV
Use CasePrivilegesOperating System
Execute code in the kernelAdministratorWindows

Detections

YARA 🏹

Expand

Exact Match

with header and size limitation

Threat Hunting

without header and size limitation

Renamed

for renamed driver files

Sigma 🛡️

Expand

Names

detects loading using name only

Hashes

detects loading using hashes only

Sysmon 🔎

Expand

Block

on hashes

Alert

on hashes

Resources


  • https://github.com/magicsword-io/LOLDrivers/issues/409
  • https://github.com/fluffycats31/vulnerable-drivers
  • https://jvn.jp/en/vu/JVNVU96854657/index.html
  • https://nvd.nist.gov/vuln/detail/CVE-2025-65001

    • Known Vulnerable Samples

    PropertyValue
    Filenamefbiosdrv.sys
    Creation Timestamp2021-08-31 03:36:53
    MD5e202f26b0ff4f8b1b8c99aec91381212
    SHA13ced179b3223e40d6e0aaab057cacf326dec6bca
    SHA2566e06493619cf1358bd2c5aafd375e78bba233b835e9d9ef21eafee30c23a62d9
    Authentihash MD5f47df8e082908ba2bcf6d25ed710bed9
    Authentihash SHA19837382375c6b7025d1c00525fc123eeacefe5eb
    Authentihash SHA256ca1c24baafb81908461d7c858749354df0648acd376265683c189c9d00e856cc
    RichPEHeaderHash MD51e4cd8be95a120502b5ddb215727962d
    RichPEHeaderHash SHA158c135d06bf1d719ba614ae6251f5e73b501ed79
    RichPEHeaderHash SHA25628d5fd83341271bd0e4dd51054afd4944ed4d875d3b6373a945ddc7641e23f66
    CompanyFUJITSU CLIENT COMPUTING LIMITED
    DescriptionFujitsu BIOS Driver
    ProductFujitsu BIOS Driver
    OriginalFilenamefbiosdrv.sys

    Download

    Certificates

    Expand
    Certificate 66deb11a5dd83ca0efcfd38af6cbf224
    FieldValue
    ToBeSigned (TBS) MD5cf840b43eba6b4ac1c52cf6524950715
    ToBeSigned (TBS) SHA1d1bb465d82a6f721af17a666983fdbcd45fcda84
    ToBeSigned (TBS) SHA256af4ef89cf35ab5a329fa1f61f5593485e439f7248db30064fbea0c4ca29f38f8
    SubjectC=JP, postalCode=212,0058, ST=Kanagawa, L=KAWASAKI, STREET_ADDRESS=1,1,2, KASHIMADA, SAIWAI,KU, O=FUJITSU CLIENT COMPUTING LIMITED, CN=FUJITSU CLIENT COMPUTING LIMITED
    ValidFrom2020-11-02 00:00:00
    ValidTo2023-11-02 23:59:59
    Signature271bb12978d9b4777e7ffb8806cc0ff447336bff56576f3c1ac618076261238797c262021eb443329312f964980722d0013b225a38df63070a409543ae644e9dd8e7ceda0666b7e46a77664e8fce0e28778d8c6093fbad68bddd7922a5089c71a30c2978cc0634ac1d1ca721a7e0ab84fd41c121411ca4fa6394f78e631a934a8f2b768d1b8c650d4dd3b532ca7a8c0e1cf065e09a6e2fcb327ac49882d424a1f4e6e8b0eebfa32b3a61492443c5473aed9472018cc9f399647e30bd59e5e501504bf1c8ef3d93263700c0f3f6c678ece2574e03ca47e0f4fe07ea6570189ed0bae4030899fe21f1cc13053e4227eac26b6d8f72fe6bd57c489cec122fc8adc5
    SignatureAlgorithmOID1.2.840.113549.1.1.11
    IsCertificateAuthorityFalse
    SerialNumber66deb11a5dd83ca0efcfd38af6cbf224
    Version3
    Certificate 3972443af922b751d7d36c10dd313595
    FieldValue
    ToBeSigned (TBS) MD53f5b269ded03667a7bad47c1885062b0
    ToBeSigned (TBS) SHA10f01247aaf8b46e3617880e0f5f5dfac696ed7a3
    ToBeSigned (TBS) SHA256593e2d49a74023555526aef9b7422b19e5b8b167391b6dee5ed292b1ca23a74c
    SubjectC=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification Authority
    ValidFrom2019-03-12 00:00:00
    ValidTo2028-12-31 23:59:59
    Signature188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95
    SignatureAlgorithmOID1.2.840.113549.1.1.12
    IsCertificateAuthorityTrue
    SerialNumber3972443af922b751d7d36c10dd313595
    Version3
    Certificate 1da248306f9b2618d082e0967d33d36a
    FieldValue
    ToBeSigned (TBS) MD5c1eabfb5994258ad955adb7c2df165e6
    ToBeSigned (TBS) SHA1fa33b3c00cebc469b269220d9eab26926c9b8ad8
    ToBeSigned (TBS) SHA25670dffac37eb787b2198816982c7d44f541d2e39a7dac069d37b367dc9f354b32
    SubjectC=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Code Signing CA
    ValidFrom2018-11-02 00:00:00
    ValidTo2030-12-31 23:59:59
    Signature4d6350ed47344a61a4dbde6a2a8c9bf100001e1d627b3ad732c2f6b3e063b3fb6100889a1b6d1007044fbeb8ea897822eb0f46ecf3465e40468912f40b775a9c2a413afcd6f4ebe7f7159533c3a18328b7de2fe494f78533832d4a4048bf9ac24f4ab18f24f4b38137d3b764b0a6236a596852425fff04ebe174657908f5a993de6b71409996ba78f1b9c8e2c30816b1ab635ac815806d745e4a757ea5b8c36cb5cfdf4a79875cc7404d6335f630d3cfb50a0e0b047fa04baebba3a5d08400933e535d34a50035696cbe9f2025100d19fb509061be398f7a8e4df69f0e1efe075112668326194895ce4ac9c17ff33a059bf96fdf887fc0239ed21e437a4531c19c4da9f059b25919e86a8d290402777c4b4bcd70be3ab2555a783ebcbb6f0310257715348af936cc4392e4ba4ff1629328255729fb5119c7a125406a8457c6b29db1bc1c0ada7c677e7d2ee9284c187ec47b3141719a4b29ec0b3d5750d2caddfd9e0551e54478dd01deb175980d5424fdf04ee3e2f883bd72bacb3d3aeef05e1792686dc861f9a6f12a0a0ba5b9f49eee983205859eebf98329d3c62c7dbd3a772e8b3742a06a82ed3b4aaa9410a4e10df817c5b65a79331892e3b575f8a1e98e0a251ee41ef19f5a8723ff9fa4519efb398011cddbb5c4a7a8806fe553d4e0e3a2c2d25b1afa32262d6a57701c3ca4582ea3f35b4b07dc3259f387a71a6d58
    SignatureAlgorithmOID1.2.840.113549.1.1.12
    IsCertificateAuthorityTrue
    SerialNumber1da248306f9b2618d082e0967d33d36a
    Version3

    Imports

    Expand
    • ntoskrnl.exe

    Imported Functions

    Expand
    • RtlInitUnicodeString
    • MmGetSystemRoutineAddress
    • KeInitializeEvent
    • KeSetEvent
    • KeWaitForSingleObject
    • IoAttachDeviceToDeviceStack
    • IofCallDriver
    • IofCompleteRequest
    • IoCreateDevice
    • IoCreateSymbolicLink
    • IoDeleteDevice
    • IoDeleteSymbolicLink
    • IoDetachDevice
    • IoInitializeRemoveLockEx
    • IoAcquireRemoveLockEx
    • IoReleaseRemoveLockEx
    • IoReleaseRemoveLockAndWaitEx
    • IoWMIRegistrationControl
    • MmMapLockedPagesSpecifyCache
    • MmAllocateContiguousNodeMemory
    • MmFreeContiguousMemory
    • MmGetPhysicalAddress
    • RtlCopyUnicodeString
    • ExFreePoolWithTag
    • IoBuildDeviceIoControlRequest
    • IoGetDeviceObjectPointer
    • IoAllocateWorkItem
    • IoFreeWorkItem
    • IoQueueWorkItemEx
    • IoRegisterPlugPlayNotification
    • IoUnregisterPlugPlayNotificationEx
    • ObfDereferenceObject

    Exported Functions

    Expand

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • .pdata
    • PAGE
    • INIT
    • .rsrc
    • .reloc

    Signature

    Expand
    {
  "Certificates": [
    {
      "CertificateType": "Leaf (Code Signing)",
      "IsCA": false,
      "IsCertificateAuthority": false,
      "IsCodeSigning": true,
      "SerialNumber": "66deb11a5dd83ca0efcfd38af6cbf224",
      "Signature": "271bb12978d9b4777e7ffb8806cc0ff447336bff56576f3c1ac618076261238797c262021eb443329312f964980722d0013b225a38df63070a409543ae644e9dd8e7ceda0666b7e46a77664e8fce0e28778d8c6093fbad68bddd7922a5089c71a30c2978cc0634ac1d1ca721a7e0ab84fd41c121411ca4fa6394f78e631a934a8f2b768d1b8c650d4dd3b532ca7a8c0e1cf065e09a6e2fcb327ac49882d424a1f4e6e8b0eebfa32b3a61492443c5473aed9472018cc9f399647e30bd59e5e501504bf1c8ef3d93263700c0f3f6c678ece2574e03ca47e0f4fe07ea6570189ed0bae4030899fe21f1cc13053e4227eac26b6d8f72fe6bd57c489cec122fc8adc5",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=JP, postalCode=212,0058, ST=Kanagawa, L=KAWASAKI, STREET_ADDRESS=1,1,2, KASHIMADA, SAIWAI,KU, O=FUJITSU CLIENT COMPUTING LIMITED, CN=FUJITSU CLIENT COMPUTING LIMITED",
      "TBS": {
        "MD5": "cf840b43eba6b4ac1c52cf6524950715",
        "SHA1": "d1bb465d82a6f721af17a666983fdbcd45fcda84",
        "SHA256": "af4ef89cf35ab5a329fa1f61f5593485e439f7248db30064fbea0c4ca29f38f8",
        "SHA384": "ff1754579815be1d7b0d17e0e3001f7811d82f96cbdae56470070a594fdee0e9d97f7820dffe48b89a61bde774a91b3a"
      },
      "ValidFrom": "2020-11-02 00:00:00",
      "ValidTo": "2023-11-02 23:59:59",
      "Version": 3
    },
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": false,
      "SerialNumber": "3972443af922b751d7d36c10dd313595",
      "Signature": "188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.12",
      "Subject": "C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification Authority",
      "TBS": {
        "MD5": "3f5b269ded03667a7bad47c1885062b0",
        "SHA1": "0f01247aaf8b46e3617880e0f5f5dfac696ed7a3",
        "SHA256": "593e2d49a74023555526aef9b7422b19e5b8b167391b6dee5ed292b1ca23a74c",
        "SHA384": "13baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9"
      },
      "ValidFrom": "2019-03-12 00:00:00",
      "ValidTo": "2028-12-31 23:59:59",
      "Version": 3
    },
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": true,
      "SerialNumber": "1da248306f9b2618d082e0967d33d36a",
      "Signature": "4d6350ed47344a61a4dbde6a2a8c9bf100001e1d627b3ad732c2f6b3e063b3fb6100889a1b6d1007044fbeb8ea897822eb0f46ecf3465e40468912f40b775a9c2a413afcd6f4ebe7f7159533c3a18328b7de2fe494f78533832d4a4048bf9ac24f4ab18f24f4b38137d3b764b0a6236a596852425fff04ebe174657908f5a993de6b71409996ba78f1b9c8e2c30816b1ab635ac815806d745e4a757ea5b8c36cb5cfdf4a79875cc7404d6335f630d3cfb50a0e0b047fa04baebba3a5d08400933e535d34a50035696cbe9f2025100d19fb509061be398f7a8e4df69f0e1efe075112668326194895ce4ac9c17ff33a059bf96fdf887fc0239ed21e437a4531c19c4da9f059b25919e86a8d290402777c4b4bcd70be3ab2555a783ebcbb6f0310257715348af936cc4392e4ba4ff1629328255729fb5119c7a125406a8457c6b29db1bc1c0ada7c677e7d2ee9284c187ec47b3141719a4b29ec0b3d5750d2caddfd9e0551e54478dd01deb175980d5424fdf04ee3e2f883bd72bacb3d3aeef05e1792686dc861f9a6f12a0a0ba5b9f49eee983205859eebf98329d3c62c7dbd3a772e8b3742a06a82ed3b4aaa9410a4e10df817c5b65a79331892e3b575f8a1e98e0a251ee41ef19f5a8723ff9fa4519efb398011cddbb5c4a7a8806fe553d4e0e3a2c2d25b1afa32262d6a57701c3ca4582ea3f35b4b07dc3259f387a71a6d58",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.12",
      "Subject": "C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Code Signing CA",
      "TBS": {
        "MD5": "c1eabfb5994258ad955adb7c2df165e6",
        "SHA1": "fa33b3c00cebc469b269220d9eab26926c9b8ad8",
        "SHA256": "70dffac37eb787b2198816982c7d44f541d2e39a7dac069d37b367dc9f354b32",
        "SHA384": "20adc5b59cb532e215f01ba09a9c745898c206555613512fea7c295ccfd17ced4fe2c5bc3274ca8a270fc68799b8343c"
      },
      "ValidFrom": "2018-11-02 00:00:00",
      "ValidTo": "2030-12-31 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Code Signing CA",
      "SerialNumber": "66deb11a5dd83ca0efcfd38af6cbf224",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

    source

    last_updated: 2026-08-31