CVE-2026-94146: BioStar BIOS Driver Flaw

How to Detect CVE-2026-94146

Start by identifying endpoints with the BioStar utility or the vulnerable driver. Useful sources include:

• Installed-application inventory
• Windows driver-service enumeration
• File and hash inventory
• Endpoint detection and response telemetry
• Software deployment records
• Driver-load events

Search for the exact filename BSMEM64_W10.sys, but also validate its path, publisher metadata, hash, and load state. Filenames can be copied or renamed by unrelated software.

A driver-load event is a useful signal when Sysmon or equivalent endpoint telemetry is enabled. Suspicious activity may include an unexpected process opening a device associated with the driver, followed by a driver load or unusual kernel-related activity.

Because the exploitation path is local and does not require a network request to the vulnerable host, network-only monitoring is unlikely to reliably detect exploitation.

PowerShell File and Driver Checks

Run the following checks locally or through an endpoint-management platform:

$paths = @(
  "$env:windir\System32\drivers\BSMEM64_W10.sys",
  "$env:windir\SysWOW64\drivers\BSMEM64_W10.sys"
)

$paths | ForEach-Object {
  if (Test-Path $_) {
    Get-Item $_ | Select-Object FullName, Length, CreationTime, LastWriteTime,
      @{Name="SHA256";Expression={(Get-FileHash $_ -Algorithm SHA256).Hash}}
  }
}

Get-CimInstance Win32_SystemDriver |
  Where-Object {
    $_.Name -match 'BSMEM|BioStar' -or
    $_.PathName -match 'BSMEM64_W10\.sys|BioStar'
  } |
  Select-Object Name, DisplayName, State, StartMode, PathName

For Sysmon deployments, investigate Event ID 6, Driver loaded, where the ImageLoaded field ends with:

\BSMEM64_W10.sys

A generic SIEM query pattern is:

EventID=6
AND ImageLoaded endswith "\\BSMEM64_W10.sys"

Also search process-access and device-interaction telemetry for unexpected user processes around the same time. The exact device name and IOCTL code are not provided in the available research, so defenders should not create a fabricated signature.

If a vendor advisory or validated proof of concept later identifies the device object or control code, update detection content accordingly.

Mitigation and Patching

No vendor-confirmed fixed version was identified. The affected version explicitly named in available records is 1.9.7.3. No supported upgrade target can be stated without inventing a version.

Do not treat an unrelated BioStar download, a repackaged installer, or a later version lacking security-release documentation as confirmed remediation.

The preferred mitigation is to remove the utility and driver from systems where BIOS-update functionality is not required. If the utility is operationally necessary:

• Restrict its use to a controlled administrative workstation.
• Limit local administrator access.
• Prevent untrusted code execution on the host.
• Monitor the driver and its associated service.
• Keep the workstation isolated from general user activity.
• Use approved change-management procedures for BIOS updates.

These controls reduce exposure but do not repair vulnerable driver code. An endpoint security product such as Get Malwarebytes → may provide additional malware and suspicious-process monitoring, but it should not be treated as a substitute for removing or disabling the vulnerable driver.

Identify the Driver Service

First identify the registered service name rather than assuming it from the filename:

Get-CimInstance Win32_SystemDriver |
  Where-Object { $_.PathName -match 'BSMEM64_W10\.sys' } |
  Format-List Name, DisplayName, State, StartMode, PathName

After confirming that the service belongs to the BioStar utility, and that disabling it will not interrupt an approved maintenance operation, stop and disable it:

Stop-Service -Name "<validated-service-name>" -Force
Set-Service -Name "<validated-service-name>" -StartupType Disabled

Do not run these commands with an unverified service name.

Remove the Utility

If the utility is no longer needed, remove it through the organization’s software-management process. For a Windows package managed by an approved installer, administrators can first locate the exact registered product:

Get-CimInstance Win32_Product |
  Where-Object { $_.Name -match 'BioStar BIOS Update Utility' } |
  Select-Object Name, Version, IdentifyingNumber

Win32_Product can trigger MSI consistency checks, so enterprise teams should prefer their software inventory platform when available.

Do not manually delete BSMEM64_W10.sys while its service is active. After removal or disablement:

1. Reboot if required by the driver state.
2. Confirm that the driver is no longer loaded.
3. Verify that the file and driver service are absent or disabled.
4. Check endpoint telemetry for later attempts to load the driver.
5. Document the affected system and remediation status.

Continue monitoring BioStar’s official support channels for a fixed release. Once a vendor-confirmed version is published, test it in a controlled group, verify the driver’s file version and hash, and deploy it through normal change management.

Until then, removal or isolation is the most defensible workaround.

Incident Response Considerations

If an affected driver is found on a system showing signs of compromise, preserve evidence before making changes where operationally possible. Record:

• The driver path, file hash, version, and timestamps
• Service configuration and current load state
• Recently installed applications and drivers
• Local administrator and user activity
• Process and driver-load telemetry
• EDR alerts and suspicious command-line activity
• Relevant Windows event logs

If a compromise is suspected, consider forensic acquisition before removing artifacts. See our guide to what forensic imaging is for background on preserving a system for investigation.

Containment decisions should follow the organization’s incident-response plan. Removing the vulnerable utility may reduce future exposure, but it does not prove that a system was never exploited.

References

The primary record is the NVD entry for CVE-2026-94146. It identifies BioStar BIOS Update Utility 1.9.7.3, the BSMEM64_W10.sys driver, the sub_110BC IOCTL handler, the local attack requirement, the 8.8 CVSS score, and the statement that an exploit has been made public.

Additional records cited in the research include the VulDB CVE record, VulDB submission record, VulDB vulnerability record, and VulDB CTI record.

The CISA Known Exploited Vulnerabilities Catalog does not currently list CVE-2026-94146. The available sources do not provide a confirmed fixed version, complete affected-version range, reproducible proof-of-concept location, or evidence of active exploitation in operational environments.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.