Skip to content
OpenAdvisories
High · 7.8 Known exploited · Ransomware Public exploit CVE-2015-2291 EUVD-2015-2389GHSA-4w4w-866c-5vgg

(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to …

Published Aug 9, 2017 · Updated Oct 1, 2026 · Assigned by mitre

Description

(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges via a crafted (a) 0x80862013, (b) 0x8086200B, (c) 0x8086200F, or (d) 0x80862007 IOCTL call.

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 1

GitHub 4 repositories

  • Tare05/Intel-CVE-2015-2291 ★ 6 · Feb 22, 2020

    PoC exploit for CVE-2015-2291

  • gmh5225/CVE-2015-2291 ★ 5 · Jun 28, 2022

    (1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly execute arbitrary code…

  • ethanedits/iqvw64e-privilege-escalation ★ 3 · Jan 25, 2026

    CVE-2015-2291 Local Privilege Escalation PoC

  • antoniorauso/NalCaller ★ 0 · Oct 18, 2026

    Arbitrary Kernel Calls via Intel NAL driver (iqvw64e.sys, CVE-2015-2291)

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References