WinRing0 Vulnerable Driver: What It Means and What to Do

Short answer: WinRing0 is an old kernel driver that fan-control, hardware-monitoring and RGB apps used to read sensors and talk to hardware. It has a real, published flaw: CVE-2020-14979 lets any local user read and write arbitrary memory and gain SYSTEM privileges. Microsoft Defender’s warning is not a sign that your fan app is malware, but it is also not a false alarm. Update the app to a version that no longer uses WinRing0 (FanControl V238+, LibreHardwareMonitor v0.9.5+, OpenRGB 1.0, current Razer Synapse), remove the leftover driver service, and do not add a Defender exclusion.

Official-source review — 18 October 2026 UTC: We checked the NVD record for CVE-2020-14979, Microsoft’s threat encyclopedia entries for the WinRing0 detections, Microsoft’s driver block rules and Device protection documentation, the FanControl README, releases and issue tracker, LibreHardwareMonitor’s releases, issues and source code, OpenRGB’s release notes on Codeberg, the Open Hardware Monitor repository, pawnio.eu and the PawnIO source, and PCWorld’s report with Razer’s statement. We did not install any of these apps, load the driver or trigger the Defender detection. Commands below come from Microsoft documentation and the apps’ own source code.

What the WinRing0 warning means

Windows Security can name the same problem in several ways. Microsoft’s threat encyclopedia lists VulnerableDriver:WinNT/Winring0 in variants .A, .B, .C, .D and .G, all rated severe, and ties them to CVE-2020-14979. Some alerts use HackTool:Win32/Winring0. On 4 September 2025, FanControl and LibreHardwareMonitor users started seeing a third name, Trojan:Win32/Vigorf.A, on files such as FanControl.sys (FanControl issue #3410) and LibreHardwareMonitor.sys (LibreHardwareMonitor issue #1844). FanControl’s developer replied in that thread: “That’s just WinRing0 being flagged (again).”

The driver itself is not a virus. Microsoft’s encyclopedia explains the actual risk: attackers use a technique called Bring Your Own Vulnerable Driver (BYOVD). They load a legitimate, signed driver with a known flaw and use it to run code with kernel privileges. From there they can switch off antivirus, install ransomware or hide persistent code. So the warning is about what other malware could do with WinRing0 on your PC, not about what your fan app does.

The vulnerability: CVE-2020-14979

According to the NVD record, published on 11 August 2020, the WinRing0.sys and WinRing0x64.sys drivers version 1.2.0, as shipped in EVGA Precision X1 up to 1.0.6, “allow local users, including low integrity processes, to read and write to arbitrary memory locations.” NVD says this lets any user gain NT AUTHORITY\SYSTEM privileges. The CVSS 3.1 score is 7.8 (High).

The CVE names EVGA’s app, but the same driver was reused across many tools. In LibreHardwareMonitor issue #984, opened in February 2023 after antivirus products began blocking WinRing0, contributors discussed creating the driver’s device with a secured access list. That issue was closed in September 2025 by replacing WinRing0 entirely.

Which apps use or used WinRing0

Microsoft’s encyclopedia entry lists tools that bundled WinRing0, including CapFrameX, EVGA Precision X1, FanCtrl, HWiNFO, Libre Hardware Monitor, MSI Afterburner, Open Hardware Monitor, OpenRGB, OmenMon, Panorama9, Razer Synapse, SteelSeries Engine and ZenTimings. PCWorld quotes the same list. Being on that list does not mean the current version still ships the driver. The table only includes apps where we read the developer’s own statement or code.

WinRing0 status by app (sources read 18 October 2026)
App	Used WinRing0?	Current status	What to do
FanControl	Yes, V237 and earlier (`FanControl.sys`)	V238 (18 September 2025) moved to PawnIO. Latest release is V283 (11 October 2026)	Update to the latest release and install PawnIO when asked
LibreHardwareMonitor	Yes, v0.9.4 and earlier	v0.9.5 (7 January 2026) swapped WinRing0 for PawnIO. Latest is v0.9.6 (14 February 2026)	Update to v0.9.6
OpenRGB	Yes, before 1.0rc2	1.0rc2 (September 2025) was the first PawnIO build. 1.0 and 1.1 (16 October 2026) use PawnIO	Update to 1.1. Avoid the separate “1.0rc2 (WinRing0)” build
Razer Synapse	Yes, older Synapse 3	Razer told PCWorld a 20 February 2025 patch removed the drivers and Synapse 4 does not use them	Update Synapse 3 or move to Synapse 4
Open Hardware Monitor	Yes, `WinRing0.sys` is in its source tree	Latest commit on the GitHub repository is from December 2020. No PawnIO version found	Replace it with an updated tool

For the other names on Microsoft’s list, such as MSI Afterburner and HWiNFO, we did not find a developer statement about WinRing0 that we could confirm, so we make no claim either way. If Defender flags a file inside one of them, update the app from its official site and scan again. Our MSI Afterburner page links the official source.

What the developers did: PawnIO

The main fix across open-source tools is PawnIO, described by its author namazso as “a scriptable universal kernel driver.” Instead of exposing raw memory and port access to any program, it runs small hardware modules. The site offers an Official edition that is digitally signed and an Unrestricted edition that is unsigned. Use the Official one. The driver source is on GitHub under the GPL, and the installer releases show 2.2.0 from 15 March 2026 as the newest.

FanControl. The V238 release notes say WinRing0 “is no longer shipped with FanControl” and that the app now asks to install PawnIO. Without it you lose motherboard sensors, but other sensors still work. The FanControl README calls updating to V238 or later “the recommended fix” for the Defender detection. Our Is FanControl safe? guide and FanControl page cover the official download.
LibreHardwareMonitor. Pull request #1857, “Swap WinRing0 to PawnIO”, was merged on 16 September 2025 and shipped in v0.9.5. That release notes that AMD Family 10h CPU support is temporarily disabled.
OpenRGB. The 1.0rc2 notes say you must install PawnIO and run OpenRGB as administrator to reach SMBus devices. The 1.1 notes say the same for RAM and older motherboards, or you can use the background service option.

What to do if Windows Security flags WinRing0

Find which app installed it. The Defender alert shows the file path. A path like C:\Program Files (x86)\FanControl\FanControl.sys tells you the app.
Update that app from its official source. Use the versions in the table. Check the download link with our download site checker, avoid the fake download sites that copy popular tools, and check the installer’s digital signature or compare its hash with our SHA-256 checker.
Leave the file quarantined. Do not restore it.
Remove the old driver service if the app is gone or updated (next section).
Restart and run a Defender scan again.

If the app has no WinRing0-free version, stop using it on that PC. A fan curve is not worth leaving a known privilege-escalation path open.

How to remove the leftover WinRing0 driver service

Updating an app does not always remove the old driver service. In LibreHardwareMonitor’s own pre-PawnIO code, the service is named R0 plus the program name (for example R0FanControl or R0LibreHardwareMonitor), and the .sys file sits next to the program’s .exe with the same name. FanControl uses that library, which matches the R0FanControl service users reported in issue #3410. Open Command Prompt as administrator and list matching driver services:

sc query type= driver state= all | findstr /c:"SERVICE_NAME: R0"

Or in PowerShell as administrator:

Get-CimInstance Win32_SystemDriver | Where-Object Name -like 'R0*' | Select-Object Name, State, PathName

Check the PathName before you delete anything. It should point to the old app’s folder. Then stop and delete the service, using the exact name you found:

sc stop R0FanControl
sc delete R0FanControl

Microsoft’s sc delete documentation says that if the service is running or in use, it is only “marked for deletion,” so restart afterwards. Microsoft also advises against deleting built-in Windows services with this command. Only remove a service whose path you recognize. After the restart, delete the old .sys file if Defender has not already removed it.

Check Memory integrity and the vulnerable driver blocklist

Microsoft’s driver block rules page says the Microsoft vulnerable driver blocklist has been on by default since the Windows 11 2022 update. It is also enforced whenever Memory integrity (HVCI), Smart App Control or S mode is on. Microsoft updates the list quarterly and ships it through monthly Windows updates. The same page warns that the built-in list does not block every vulnerable driver.

Open Windows Security → Device security → Core isolation details. Microsoft’s Device protection guide says Memory integrity “makes it difficult for malicious programs to use low-level drivers to hijack your PC.” If it refuses to turn on because of an incompatible driver, Microsoft advises getting an updated driver from the maker, or removing the app that uses it. If the driver it names is an old WinRing0 copy, removing it as shown above is the fix. Keep both settings on.

Why you should not add a Defender exclusion

An exclusion stops the alert but leaves the flaw in place. PCWorld advises against it for the same reason. While the driver is installed, malware that reaches your account could use it to get kernel access, and Defender will no longer warn you about that file. One user in FanControl issue #3410 had already excluded WinRing0 and was flagged again under the new Vigorf.A name. Excluding detection names one by one does not fix anything. Updating does.

Questions

Is WinRing0 a virus?

No. It is a legitimate hardware-access driver with a known flaw. Microsoft’s encyclopedia treats it as a tool attackers can abuse, which is why it is rated severe.

Is it safe to click “Allow on device”?

It is not recommended. Allowing it keeps a driver with a CVSS 7.8 privilege-escalation flaw on your PC. Update the app instead.

My fans stopped responding after Defender quarantined the file. What now?

The app has lost its driver. Install the current FanControl, LibreHardwareMonitor or OpenRGB build and install PawnIO when it asks. FanControl says motherboard sensors need PawnIO.

Does PawnIO trigger the same warning?

FanControl’s README says moving to PawnIO “fixes the anti-virus problems encountered with WinRing0.” We did not test PawnIO with Defender ourselves.

WinRing0 Vulnerable Driver Warning: Which Apps Use It and What to Do