A signed vulnerable driver is a legitimate kernel driver that carries a trusted digital signature but has known security flaws. Attackers abuse this trust to load code into the Windows kernel, where they can bypass user-mode protections, disable endpoint tools, kill security processes, or manipulate memory with more authority than ordinary malware. This abuse is often called BYOVD, or “bring your own vulnerable driver.”
It matters because many defenses assume that signed drivers are safe to load. In real attacks, adversaries use vulnerable drivers to weaken EDR, hide malicious activity, or make persistence harder to remove. Defenders reduce this risk by maintaining driver blocklists, monitoring driver loads, enforcing vulnerable-driver protection features, and removing outdated or unnecessary kernel drivers from endpoints.