---
id: "CVE-2015-2291"
kind: "vulnerability"
aliases: ["CVE-2015-2291"]
title: "(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows\u2026"
severity: "high"
cvss: 7.8
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Intel Ethernet Diagnostics Driver for Windows", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "intel ethernet diagnostics driver iqvw32.sys", "fixed": [], "affected": "= 1.03.0.7", "ecosystem": "vendor"}, {"name": "intel ethernet diagnostics driver iqvw64.sys", "fixed": [], "affected": "= 1.03.0.7", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "intel-ethernet", "ransomware", "self-hosted", "windows"]
not_affected_if: ["no-iqvw-driver-installed"]
published_at: "2017-08-09T18:29:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-2291", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2291", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# (1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows…

Intel's Ethernet Diagnostics Driver for Windows (IQVW32.sys and IQVW64.sys) has an unspecified flaw that lets an attacker crash the system with a denial-of-service. CISA lists it as actively exploited, and the KEV entry notes ransomware use.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Intel Ethernet Diagnostics Driver for Windows affected ? fixed ?
- vendor:intel ethernet diagnostics driver iqvw32.sys affected = 1.03.0.7 fixed ?
- vendor:intel ethernet diagnostics driver iqvw64.sys affected = 1.03.0.7 fixed ?

## How to check

Search Windows for IQVW32.sys or IQVW64.sys (e.g. dir C:\Windows\System32\drivers\IQVW*.sys) and check whether the Intel diagnostics package is installed.

## Fix

Apply updates per vendor instructions (Intel advisory); remove the driver if it is not needed.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-2291
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2015-2291

## From the sources

(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges via a crafted (a) 0x80862013, (b) 0x8086200B, (c) 0x8086200F, or (d) 0x80862007 IOCTL call.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_