CVE-2026-81581

HighCVSS 8.8/10Last modified Sep 3, 2026

Description

Improper validation of memory boundaries in WibuKey64.sys of WibuKey up to 6.70 for Windows can be exploited by an attacker by setting the pointers outside the scope of the program. This usually results in a denial of service, yet we cannot rule out the possibility of exploits that can cause Remote Code Execution and Privilege Escalation (since the driver runs with system privileges).

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Aug 27, 2026
Last modified
Sep 3, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-815835.4The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite inCVE-2026-81597.5multiparty@4.2.3 and lower versions are vulnerable to denial of service via regular expression backtracking in the Content-Disposition filenCVE-2026-81617.5multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request witCVE-2026-81627.5multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request witCVE-2026-816238.8IBM Guardium Data Protection 12.2 could allow an authenticated user to execute arbitrary commands with low user privileges on the system dueCVE-2026-816247.5Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. CVE-2026-816258.8A remote attacker with user privileges may use a malicious or compromised NASL vulnerability test (VT) on the affected products to trigger aCVE-2026-816268.6IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Load Balancer Groups component. An unauthenticated uCVE-2026-816278.2A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the optiCVE-2026-81638.8The Infility Global WordPress plugin before 2.15.19 does not properly sanitize and escape some parameters before using them in SQL statementCVE-2026-816308.1The Botslab G980H dash camera firmware does not adequately verify the authenticity of firmware updates. The update process retrieves firmwarCVE-2026-816327.2Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access lo
CVE-2026-81581: High severity, CVSS 8.8 | Vulnix