CVE-2024-26507CWE-1286

CVE-2024-26507

High · published June 10, 2024

CVSS v3.1

7.8

EPSS

Percentile

9.8

In the wild

Unconfirmed

What it is

An issue in FinalWire AIRDA Extreme, AIDA64 Engineer, AIDA64 Business, AIDA64 Network Audit through 7.00.6742 allows a local attacker to escalate privileges via the DeviceIoControl call associated with MmMapIoSpace, IoAllocateMdl, MmBuildMdlForNonPagedPool, or MmMapLockedPages components.

The record

Technical detail

CVSS v3.1: 7.8 · HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00203 · 9.8th percentile
Weakness: CWE-1286 · Improper Validation of Syntactic Correctness of Input
Published: 2024-06-10T20:15Z

References (6)

https://belong2yourself.github.io/vulnerabilities/docs/AIDA/Elevation-of-Privileges/readme/ · [email protected]https://github.com/PaulDotSH/vuln-driver-aida64 · [email protected]https://github.com/klezVirus/AIDA64DRIVER-EoP · [email protected]https://github.com/magicsword-io/LOLDrivers/issues/461 · [email protected]https://www.loldrivers.io/drivers/deffeb8d-c7d9-46b9-a921-7d8d096460ef/ · [email protected]https://belong2yourself.github.io/vulnerabilities/docs/AIDA/Elevation-of-Privileges/readme/ · af854a3a-2127-422b-91ae-364da2661108

EPSS history

Timeline

10 JUN 00:00Z
An issue in FinalWire AIRDA Extreme, AIDA64 Engineer, AIDA64 Business, AIDA64 Network Audit v.7.00.6700 and before allows a local attacker to escalate…
cvelistv5