Colorful iGameCenter CVE-2026-109520

Exploitation requires local access with a valid low-privileged session (PR:L) and the ability to open and issue IOCTLs to the AMDRyzenMasterDriver.sys device exposed by Colorful iGameCenter 2.0.0.82; the driver's Dispatch Handler passes an attacker-controlled SystemBuffer into MmMapIoSpace, permitting arbitrary physical-memory mapping. Limiting factors: no remote vector (attacker must already execute code on the host), the vulnerable driver must be installed and loaded (default when iGameCenter is deployed), and no user interaction by a victim is involved. There is no network-exploitable path, which materially reduces real-world exposure.

Signals are moderately consistent and point to a locally-exploitable privilege-escalation issue rather than a remotely-wormable threat. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) and the description ('attack needs to be launched locally') agree: this is a local vulnerability requiring an existing low-privileged foothold, not remote-unauthenticated access, so the 9.3 score reflects high impact (full kernel-level compromise via arbitrary physical-memory mapping) gated behind local access. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no evidence of active or widespread exploitation; EPSS for local driver flaws is typically very low. The core weakness (CWE-267, Privilege Defined With Unsafe Actions) combined with a MmMapIoSpace primitive is a well-understood and highly reliable local-privilege-escalation pattern (BYOVD-style), meaning that once a POC appears exploitation is usually trivial and deterministic. Conflicting/weak signals to note: the sole source is VulDB with a non-responsive vendor, so affected-version scope and patch status are unconfirmed; and the 'Information Disclosure' tag understates the issue - a MmMapIoSpace exposure enables arbitrary physical read AND write, i.e. full privilege escalation, which matches CWE-267 better than pure disclosure. Net: a genuine high-impact LPE for affected hosts, but lower real-world urgency than the 9.3 implies because it needs local code execution first and shows no exploitation evidence.

An attacker who already has a low-privileged local session (e.g. via phishing, a malicious download, or a compromised standard user account) opens a handle to the AMDRyzenMasterDriver.sys device and sends a crafted IOCTL whose SystemBuffer argument drives MmMapIoSpace to map arbitrary physical memory into user space. By reading and writing kernel structures through this mapping they overwrite a process token or kernel data to gain SYSTEM/kernel privileges. No public exploit was identified at time of analysis, but this driver-IOCTL pattern is historically simple to weaponize.