The Dell `dbutil 2 3.sys` driver contains an insufficient access control vulnerability. This issue allows a local authenticated user to escalate privileges, cause a denial of service, or disclose protected information. In real-world incidents, the Lazarus group exploited this flaw using a Bring Your Own Vulnerable Driver (BYOVD) technique—where a legitimate but vulnerable driver is installed on the target system—to deploy the FudModule rootkit. This allowed the attackers to read and write kernel memory, effectively disabling multiple Windows security monitoring mechanisms to execute commands with kernel-level privileges. The campaign targeted individuals in the aerospace industry in the Netherlands and political journalists in Belgium via phishing emails disguised as job offers from Amazon.