dbutil_2_3.sys

dbutil_2_3.sys is a Dell driver used by firmware and BIOS update utilities such as Dell Command Update. It is on the LOLDrivers list because of CVE-2021-21551, a well-publicized cluster of memory-corruption and arbitrary read/write flaws disclosed by SentinelLabs in 2021, and present in the driver since 2009. The vulnerable driver shipped on hundreds of millions of Dell systems for over a decade before the disclosure.

Why it persists: Dell published a remediation advisory and a patched driver, but the older signed binary still loads on modern Windows. Removal involves running Dell's cleanup utility or manually deleting the driver file and registry entries; many systems still have copies on disk.

On the public record: dbutil_2_3.sys is one of the most-cited BYOVD targets in published security research from 2021 onward. It has been documented in incident-response reports as a driver attackers brought with them after initial compromise to disable endpoint protection. Microsoft added explicit blocks for it to the Vulnerable Driver Blocklist.

It is common on Dell systems where Dell Command Update or similar tools were installed. Follow Dell's published remediation, then update Dell's current software for your hardware.

dbutil_2_3.sys is listed as a known-vulnerable driver on the public LOLDrivers project. 3 distinct binary hashes matching this filename are on record, meaning multiple versions of the file have been observed.