cve-2026-3437

Arbitrary physical memory read/write in portwell.sys (Portwell Engineering Toolkits v4.8.2) via MmMapIoSpace. Enables LPE/SYSTEM escalation and BYOVD by interacting with the driver's IOCTL interface.

analysis

The driver registers a dispatch routine for IRP_MJ_DEVICE_CONTROL to handle DeviceIoControl calls from usermode.

Inside the dispatch routine we can find a call to sub_11F80.

Looking inside this function reveals the following:

1. Arbitrary physical memory write via MmMapIoSpace
2. No validation of user-supplied arguments
3. A usermode caller can pass an arbitrary physical address and data

Going back to the dispatch routine, we can also find a call to sub_11E40.

Looking inside this function reveals the following:

1. Arbitrary physical memory read via MmMapIoSpace
2. No validation of user-supplied arguments

usage

sc create portwell binPath=C:\windows\temp\portwell.sys type=kernel
sc start portwell

.\cve-2026-3437.exe

references

• 🔍 SentinelOne Analysis
• 🛡️ LOLDrivers
• 📋 NVD Record
• 🐙 GitHub Advisory