Microsoft Defender Flags WinRing0 Driver as Vulnerable: What You Need to Know

Microsoft Defender Antivirus has recently begun flagging the WinRing0 driver as a security threat, specifically identifying it as "VulnerableDriver:WinNT/Winring0." This detection is valid due to known vulnerabilities in the driver, notably documented under CVE-2020-14979.
Understanding WinRing0 and Its Vulnerabilities
WinRing0 is a kernel-level driver that allows software applications to access hardware resources directly. It's commonly used in hardware monitoring and fan control applications to provide real-time data and control over system components. However, versions up to 1.2.0 of this driver have been identified as vulnerable, allowing unprivileged local users to read and write arbitrary memory locations. This flaw can be exploited to gain elevated system privileges, posing a significant security risk.
Impact on Applications
Several popular applications rely on WinRing0 for hardware monitoring and control functionalities. These include:

• Fan Control: A free tool used to manually control PC fan speeds.
• HWiNFO: A system information and diagnostic tool.
• Open Hardware Monitor: An open-source hardware monitoring application.
• Razer Synapse & SteelSeries Engine: Peripheral management software that sometimes uses similar low-level drivers.

Users of these applications have reported that Microsoft Defender is flagging them due to their reliance on the vulnerable WinRing0 driver. This has led to disruptions in functionality, such as uncontrollable fan speeds and inaccurate system diagnostics.
Developer and Vendor Responses
In response to these security concerns, developers and vendors have taken various actions:

• Fan Control: The developer acknowledged the issue, stating that the vulnerability has been known and that users should review the risks before taking action with Defender.
• Razer: Released a security patch for Synapse 3 on February 20, 2025, moving away from the vulnerable driver. Users are encouraged to update to the latest version or upgrade to Synapse 4, which does not use the vulnerable driver.

Recommendations for Users
If you encounter this alert from Microsoft Defender, consider the following steps:

• Update Affected Applications: Check for updates from the software vendors. Many are releasing patches to replace or mitigate the vulnerabilities associated with WinRing0.
• Assess the Risk: Understand the potential security risks of continuing to use applications that rely on the vulnerable driver.
• Consider Alternatives: If updates are not available, explore alternative applications that do not use vulnerable drivers.
• Stay Informed: Regularly check for communications from software vendors and trusted tech news sources for the latest information and guidance.

By taking these steps, you can help ensure the security and functionality of your system while using hardware monitoring and control applications.

---

Source: Microsoft Support Microsoft Defender Antivirus alert - VulnerableDriver:WinNT/Winring0 - Microsoft Support