phymemx64.sys

Huawei MateBook Manager physical memory driver

From Huawei Technologies

Status

On a known-vulnerable list

Known variants

2 distinct hashes

Public CVEs

Field notes

phymemx64.sys is a kernel driver from Huawei, shipped with MateBook Manager (PC Manager) on Huawei MateBook laptops. It is a copy of the open-source WinIO library and provides unrestricted physical memory read/write access to any calling process.

Microsoft's own Defender ATP research team discovered and reported the vulnerabilities in 2018, and Huawei patched them in January 2019 (PCManager 9.0.1.70). The driver is on Microsoft's Vulnerable Driver Blocklist and will not load on systems with Memory Integrity enabled. If you see it, update your Huawei PC Manager or remove it.

What the record shows

phymemx64.sys is listed as a known-vulnerable driver on the public LOLDrivers project. 2 distinct binary hashes matching this filename are on record, meaning multiple versions of the file have been observed.

Public CVEs

CVE-2019-5241 CVE-2019-5242

What this means, plainly

Presence is not proof of misuse. Driver files on the LOLDrivers list commonly ship with legitimate hardware tools, gaming software, or vendor utilities. Their presence is recorded as evidence on a record. It is never treated as a verdict about a person.

Source

Status data comes from the public LOLDrivers project, a community-curated registry of drivers known to be vulnerable or malicious. The snapshot Vera uses was refreshed July 10, 2026. CVE links go to the NIST National Vulnerability Database.

In plain words

Kernel driver BYOVD Ring 0 Code-signing certificate Certificate revocation The full glossary →

Cite this entry

Vera Project. “phymemx64.sys.” Vera Field Guide (Driver). The Vera Project. https://www.veraproject.xyz/field-guide/drivers/phymemx64-sys