The silabser.sys driver for CP210x devices up to version 11.5.0 contains an improper handling of length parameter inconsistency (CWE-130). A local unprivileged user with a malicious device can exploit this flaw by sending malformed packets, resulting in leakage of up to 145 bytes of uninitialized kernel pool memory. This vulnerability affects Windows 10 and earlier operating systems.

An attacker with local unprivileged access and a malicious device can leak a small amount (up to 145 bytes) of uninitialized kernel memory. The CVSS 4.0 base score is 2.4, indicating low severity. There is no indication of privilege escalation, denial of service, or remote exploitation. No known exploits are reported in the wild.

No official patch or remediation guidance is currently provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid connecting untrusted devices to systems running affected versions of the silabser.sys driver.