Critical Local Privilege Escalation Vulnerabilities in BioStar Software

• •Three critical CVEs (CVE-2026-94128, CVE-2026-94142, CVE-2026-94129) identified in BioStar products.
• •All vulnerabilities allow local privilege escalation through IOCTL handler manipulation.
• •Publicly disclosed exploits increase risk of system compromise and credential theft.

Three critical vulnerabilities have been identified in BioStar software products, including BioStar VIVID LED DJ (CVE-2026-94128), BioStar Temperature Monitor Utility (CVE-2026-94142), and BioStar VALKYRIE AURORA (CVE-2026-94129). Each vulnerability allows for local privilege escalation through manipulation of IOCTL handlers, requiring local access to exploit. The exploits are publicly disclosed, posing significant risks of arbitrary kernel-level memory modification and potential system compromise. Affected systems include Windows workstations and servers running the respective BioStar software. The vendor has not responded to disclosure attempts, and no specific KEV, SSVC, or EPSS statuses have been provided, leaving the likelihood of active exploitation unassessed. Immediate remediation is advised, including patching and restricting local logons.