High severity · published Aug 27, 2026
CVE-2026-81581
User input in WibuKey is used (without proper sanitization) to compute the address of a pointer, which can be exploited to let the user point to any storage, to which Windows responds with a denial of service.
8.8
CVSS
0.2%
EPSS
No
On KEV
Description
Improper validation of memory boundaries in WibuKey64.sys of WibuKey up to 6.70 for Windows can be exploited by an attacker by setting the pointers outside the scope of the program. This usually results in a denial of service, yet we cannot rule out the possibility of exploits that can cause Remote Code Execution and Privilege Escalation (since the driver runs with system privileges).
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WI
wibukey · wibu-systems-ag
before 6.71 · source: vendor
Affected product
WI
wibukey
wibu-systems-ag
More from wibukey
8.8
CVE-2026-81579
An untrusted Pointer Dereference can be exploited to escalate privileges by an unprivileged user on Windows
7.0
CVE-2026-84854
Out of Bound Write on WibuKey for Windows