Low Severity
CVE-2026-2039819
Published: Nov 12, 2026
CVE-2026-2039819 is a BYOVD PoC for HWiNFO (HWiNFO_x64_216.sys)
# CVE-2026-2039819-PoC
CVE-2026-2039819-PoC is a writeup of the signed **HWiNFO AMD64 kernel driver** (`HWiNFO_x64_216.sys`, v12.16). <br />
It documents a **kernel address disclosure**, an **unvalidated MSR write path**, and a **BYOVD loading posture** found through reverse engineering. <br />
<details>
<summary>Table of Contents</summary>
<ol>
<li><a href="#overview">Overview</a></li>
<li><a href="#why-this-matters">Why this matters</a></li>
<li><a href="#what-does-this-audit-cover">What does this audit cover?</a></li>
<li><a href="#not-claimed">Not claimed</a></li>
<li><a href="#reproduction">Reproduction</a></li>
<li><a href="#roadmap">Roadmap</a></li>
<li><a href="#conclusion">Conclusion</a></li>
</ol>
</details>
# Overview
**Severity band: Medium.** The prerequisite is `SeLoadDriverPrivilege`. <br />
Ceiling: `AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H` = **6.7**. A filing limited to the MSR and firmware exposure lands at **4.4**. <br />
| | |
|---|---|
| Product | HWiNFO — AMD64 Kernel Driver |
| Binary | `HWiNFO_x64_216.sys` (`HWiNFO_x64.SYS`) |
| SHA-256 | `aae05a5c3fb0e1ac3174cddab9f08be450fa0a75f4ea67b29e98a285ca466476` |
| Version | 12.16, vendor REALiX |
| Signature | Valid — *Microsoft Windows Hardware Compatibility Publisher*, Microsoft-timestamped (WHQL / attestation) |
| Device | `\Device\HWiNFO_216`, `\DosDevices\HWiNFO_216`; device type `0x85FE`, 95 IOCTLs |
| Verified on | Windows x64, AMD Ryzen 7 7700X (`AuthenticAMD`), service `HWiNFO_216` |
| Weakness | CWE | Status |
|---|---|---|
| Exposed IOCTL surface, single open-time authorization, no per-operation check | CWE-782, CWE-863 | Measured |
| Kernel address disclosure through an MSR read | CWE-200 | Measured |
| Unvalidated MSR index on the write path, no ring-0 exception handling | CWE-617, CWE-248 | Proven statically, not executed |
| Signed-but-abusable driver (BYOVD) usable outside its installer | — | Measured |
# Why this matters
The device object carrie