CVE-2015-2291

(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges via a crafted (a) 0x80862013, (b) 0x8086200B, (c) 0x8086200F, or (d) 0x80862007 IOCTL call.

First PoC 2015-03-14
4235 days →First cited attacker 2026-10-17

Exploited in the wild: Yesadded 2023-02-10 · due 2023-03-03 · known ransomware use. An observation, not a forecast.
EPSS · 30-day forecast: 9%Chance of exploitation in the next 30 days, 95th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD · HIGH: 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Internet exposure: not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

1 known · links only

Exploit-DB1

Intel Network Adapter Diagnostic Driver - IOCTL Handling ↗
created 2015-03-14

On the wire

0 dispatches

No dispatch on our wire has named this CVE yet.

Cited as exploited by

Scattered Spider
1. “Scattered Spider has deployed a malicious kernel driver through exploitation of CVE-2015-2291 in the Intel Ethernet diagnostics driver for Windows (iqvw64.sys).”
  cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
2. “the CrowdStrike Falcon ® platform prevented a novel attempt by SCATTERED SPIDER to deploy a malicious kernel driver through a vulnerability (CVE-2015-2291) in the Intel Ethernet diagnostics driver.”
  cited as exploiting · source: crowdstrike.com ↗ · 2026-10-17

Each actor is cited by the quoted source, linked under the quote. A citation is that source's claim, not our confirmation.

References

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on Telegram KEV RSS API

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.

Signals

Exploits

Exploit-DB1

On the wire

Watch this one?