As reported by BleepingComputer, Microsoft has begun rolling out a permanent fix for a known issue causing system crashes and gaming failures on Windows 11 24H2 and 25H2 devices. The root cause has been traced to the inpoutx64.sys driver — a low-level kernel driver commonly installed by peripherals with built-in RGB lighting. Microsoft's resolution is to block the driver entirely on affected systems.

Security Impact: While this story is primarily a stability fix, Shield53 views it through a security lens because inpoutx64.sys represents a class of legacy kernel drivers that pose significant risk beyond blue screens.

While this story is primarily a stability fix, Shield53 views it through a security lens because inpoutx64.sys represents a class of legacy kernel drivers that pose significant risk beyond blue screens. This driver is a generic I/O port access driver that grants direct hardware-level read/write capabilities from user mode. It has been circulating for years, bundled with RGB control software, fan controllers, and various peripheral utilities. From a security perspective, any driver providing direct port I/O access is a potential bring-your-own-vulnerable-driver (BYOVD) vector.

Security Implications Beyond Stability

The same characteristics that made inpoutx64.sys crash systems — uncontrolled kernel access with no proper input validation — are what make it attractive to attackers. Threat actors routinely leverage legitimate-looking kernel drivers to gain elevated privileges or bypass security controls. Microsoft's decision to block this driver is a positive step, but it also confirms that this driver was running on countless systems without adequate scrutiny.

The fact that a generic I/O port access driver was widely deployed via consumer peripheral software on Windows 11 systems — including enterprise-managed devices — underscores a persistent blind spot in driver governance and endpoint hardening.

Who Is Affected

Security Implications Beyond Stability
Consumer devices: Receiving the automatic block rollout, which began August 26, 2026, at 6 PM PT and may take up to 24 hours to propagate. A restart is required.
Enterprise-managed devices: Will NOT receive the automatic fix. IT administrators must manually apply a registry-based workaround.
Affected Windows versions: Windows 11 24H2 and 25H2 specifically.

Enterprise Manual Mitigation

For managed devices, administrators should disable the driver via the registry. Back up the registry before making changes.

  1. Open Registry Editor (regedit)
  2. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\inpoutx64
  3. Set the Start value to 4 (disabled)
  4. Restart the system

This block will also be included in the September 2026 Windows security updates and future releases, making it persistent across updates.

Shield53 Recommendations

  • Inventory kernel drivers enterprise-wide: Use tools like Microsoft's driverquery or EDR telemetry to identify all third-party kernel drivers across your fleet. Flag any instances of inpoutx64.sys or similar generic I/O port drivers.
  • Deploy the registry fix via GPO or Intune: Don't wait for the September update cycle. Push the Start=4 registry change to all Windows 11 24H2/25H2 managed endpoints immediately.
  • Enable Microsoft Vulnerable Driver Blocklist: Ensure that the built-in blocklist is enabled via Group Policy or Intune. This provides ongoing protection against known vulnerable drivers beyond just inpoutx64.sys.
  • Audit peripheral software deployments: RGB control utilities, fan controllers, and gaming peripheral software often install kernel drivers silently. Establish a policy requiring security review of any software that installs kernel-level components.
  • Implement WDAC or AppLocker policies: Windows Defender Application Control can restrict which kernel drivers are allowed to load, preventing future incidents from unvetted peripheral drivers.
  • Communicate to users: Inform employees that RGB lighting software may stop functioning after the fix. Set expectations to reduce helpdesk volume.

The broader takeaway for security teams is that peripheral ecosystem software remains an underappreciated attack surface. Consumer-grade utilities shipping kernel drivers with broad hardware access capabilities have no place on enterprise endpoints without rigorous vetting. Use this incident as a catalyst to audit your driver landscape and implement proactive controls rather than waiting for the next driver-related issue to surface.