Published CVEs, driver bug writeups, and proof-of-concept code from Windows kernel driver research.
CVE-2026-20495: MediaTek mtkbtfilterx.sys Missing Authorization
MediaTek Bluetooth filter driver issue where four IOCTL handlers bypassed the driver’s intended permission check. A standard local user could read Bluetooth state and modify page-scan, advertising, and deferred radio-switch parameters without elevation.
- Vendor: MediaTek
- Component:
mtkbtfilterx.sys - Severity: Medium (CVSS 4.4)
- Class: missing authorization
- Advisory/writeup and PoC: CVE-2026-20495
CVE-2026-20456: MediaTek mtkwl6ex.sys Missing MMIO Bounds Check
MediaTek WLAN driver issue where an extended MMIO access path accepted an attacker-controlled address without validating it against the mapped hardware range. A standard local user could trigger an out-of-bounds write and crash Windows.
- Vendor: MediaTek
- Component:
mtkwl6ex.sys - Severity: Medium (CVSS 5.5)
- Class: out-of-bounds write
- Advisory/writeup and PoC: CVE-2026-20456
CVE-2026-3508: ASUS AsusWmiAcpi.sys Heap Over-Read
Kernel driver research finding in ASUS System Control Interface. The issue was a METHOD_BUFFERED IOCTL size validation bug where the driver trusted an embedded length field and read beyond the actual buffered input allocation.
- Vendor: ASUS
- Component:
AsusWmiAcpi.sys - Severity: Medium (CVSS 6.8)
- Class: buffered IOCTL size validation bug
- Advisory/writeup: CVE-2026-3508
CVE-2026-6737: ASUS AsusPTPFilter.sys Insecure Device Object Permissions
ASUS Precision Touchpad Filter driver issue where named device objects were created without explicit SDDL permissions, exposing driver IOCTL handlers to standard local users. Fixed in AsusPTPFilter version 16.0.0.46 or later.
- Vendor: ASUS
- Component:
AsusPTPFilter.sys - Severity: Low (CVSS 2.0)
- Class: missing device object permissions
- Advisory/writeup: CVE-2026-6737