CVE-2026-81579 wibu-systems-ag CVE debrief

Who should care

System administrators and security teams responsible for managing WibuKey for Windows installations, particularly in environments where local privilege escalation could have significant impacts, should prioritize patching or upgrading to version 6.71 or later. This includes teams managing systems in high-security environments, critical infrastructure, or where unauthorized access could lead to severe consequences. Additionally, IT personnel overseeing software updates and vulnerability management should ensure timely remediation of this vulnerability to prevent potential system compromise and data breaches.

Technical summary

The WibuKey2_64.sys kernel driver in WibuKey for Windows before version 6.71 is vulnerable to an untrusted pointer dereference. This allows an attacker to exploit a write-what-where primitive, enabling local privilege escalation. The vulnerability can be leveraged to execute arbitrary code, run an administrator shell, or gain full control over the system. Immediate attention is required to prevent potential exploitation. The affected product is WibuKey for Windows, and the vulnerability is specific to the kernel driver component.

Defensive priority

This vulnerability allows local privilege escalation via an untrusted pointer dereference in the WibuKey2_64.sys kernel driver. Immediate attention is required to prevent potential exploitation.

Recommended defensive actions

• Apply the vendor-provided patch or upgrade to version 6.71 or later of WibuKey for Windows.
• Restrict access to the WibuKey2_64.sys kernel driver to only necessary users and processes.
• Monitor system logs for suspicious activity related to the WibuKey driver.
• Consider implementing additional security controls, such as driver signing and verification.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE description indicates an untrusted pointer dereference in WibuKey for Windows before version 6.71, allowing a write-what-where primitive for local privilege escalation. Limited details are available from the CVE Program and NVD.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.