BYOVD: Exploiting Vulnerable Windows Kernel Drivers Without Their Target Hardware

Researchers published a technical analysis demonstrating that many Windows kernel-mode drivers can be interacted with from user mode even without the hardware they were written for. Hardware-gating was considered a practical barrier to exploiting certain vulnerable drivers, but the work shows this barrier can often be circumvented. The findings have direct implications for BYOVD (Bring Your Own Vulnerable Driver) attacks — specifically the pool of signed-but-vulnerable drivers that can be abused for privilege escalation and EDR evasion even when the associated hardware is absent.