An issue in FinalWire AIRDA Extreme, AIDA64 Engineer, AIDA64 Business, AIDA64 Network Audit v.7.00.6700 and before allows a local attacker to… (CVE-2024-26507)

CVE-2024-26507 is a local privilege escalation vulnerability affecting FinalWire AIRDA Extreme, AIDA64 Engineer, AIDA64 Business, and AIDA64 Network Audit up to version 7.00.6700. The flaw arises from improper handling of DeviceIoControl calls associated with MmMapIoSpace, IoAllocateMdl, MmBuildMdlForNonPagedPool, or MmMapLockedPages components. This allows a local attacker with limited privileges to escalate their privileges on the affected system. The CVSS v3.1 base score is 7.8, indicating high severity with impact on confidentiality, integrity, and availability.

A local attacker can exploit this vulnerability to gain elevated privileges on the affected system, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability of the system as indicated by the CVSS vector (C:H/I:H/A:H). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor FinalWire's advisories for updates. In the meantime, restrict local access to trusted users only to reduce risk.