CVE-2015-2291Patch(intel / ethernet_diagnostics_driver_iqvw32.sys)

LOWCVSS 7.8 · HIGHCISA KEV

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch intel ethernet_diagnostics_driver_iqvw32.sys systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges via a crafted (a) 0x80862013, (b) 0x8086200B, (c) 0x8086200F, or (d) 0x80862007 IOCTL call.

intel CVEs Back to dashboard

1.0/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2023-03-03. Apply updates per vendor instructions.

Patch / fix

Vendor / third-party advisories

Other references

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-2291

Weakness type (CWE)

CWE-20

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

ethernet_diagnostics_driver_iqvw32.sys
ethernet_diagnostics_driver_iqvw64.sys
windows

Threat summary

Patch or workaround signal is available
3 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
Disclosure: 1 classified signal
Peaked 2d ago at 1 mentions (2026-06-13); latest day: 1
3 total mentions across 3 days

Affected systems

Vendors

intel microsoft

Products

ethernet_diagnostics_driver_iqvw32.sysethernet_diagnostics_driver_iqvw64.syswindows

2 versions affected across 3 products

Deep dive

Activity timeline3 mentions / 3d

Signal classification2 categories

Patch

150.0%

Disclosure

150.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-13	1	Patch1
2026-09-13	1	Disclosure1

Full discourse3 posts

Jose Enrique Hernandez@_josehelps2d
MANTLEMAZE goes further. Under the costume of fake Google/Microsoft IP, the loader's PDB path points at iqvw64e.sys, the Intel Ethernet diagnostics driver (CVE-2015-2291) abused for BYOVD. ROZESHELL pairs the same AI-evasion comment with AMSI bypass and runtime compile via csc.exe. iqvw64e is already on LOLDrivers: https://www.loldrivers.io/drivers/1d2cdef1-de44-4849-80e5-e2fa288df681/ csc.exe is on LOLBAS: https://lolbas-project.github.io/lolbas/Binaries/Csc/
11021139
3.7K followersView on X
voidsip@voidsip44d
Disclosure
Embedded in memory as a raw file image, staged for writing: Intel's iQVW64.SYS, v1.03.0.7, signed by Intel, compiled 2013. That's CVE-2015-2291. Its IOCTLs — NAL_KKMEMCPY, NAL_KUMEMCPY, NAL_KMEMSET, plus MmMapIoSpace — hand arbitrary kernel read/write to any user-mode caller. SHA256 bbe08f20fd4f7891ff2ea9257f319c35df1e3dfa74feab888a8823b832875d1f
Post summary
The text announces CVE-2015-2291 and details technical mechanisms (IOCTLs enabling arbitrary kernel read/write) in Intel's iQVW64.SYS driver, providing a file hash, but does not mention a patch, exploit tool, or active exploitation.
1000056
504 followersView on X
PatchDay Alert@patchdayalert137d
Patch
Scattered Spider didn't need a zero-day. They used a decade-old Intel driver Windows still loads to reach the kernel and patch out your EDR. CVE-2015-2291, BYOVD, and the defenses you can turn on right now. https://patchdayalert.com/blog/intel-driver-cve-2015-2291-byovd-blocklist/?utm_source=twitter&utm_medium=social&utm_campaign=auto-drip&utm_content=intel-driver-cve-2015-2291-byovd-blocklist
Post summary
The message highlights CVE‑2015‑2291, stressing users enable defenses and provides a link to a PatchDayAlert blog detailing blocklist steps.
0000045
52 followersView on X

CPE platform detail3 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

3 of 3 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	intel	ethernet_diagnostics_driver_iqvw32.sys	1.03.0.7	-	-
App	intel	ethernet_diagnostics_driver_iqvw64.sys	1.03.0.7	-	-
OS	microsoft	windows	-	-	-

Explore more

Back to dashboard intel CVEs microsoft CVEs ethernet_diagnostics_driver_iqvw32.sys vulnerabilities