What is the CVSS score of CVE-2026-12166?

CVE-2026-12166 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

GameFirst Anti-Cheat CVE-2026-12166

EUVD-2026-41377 MEDIUM

2026-07-02 certcc

GHSA-rp8q-7vcj-j55j

Denial Of Service Gamefirst Anti Cheat Little Orbit

5.5

CVSS 3.1 · Vendor: certcc

Severity by source

Vendor (certcc) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.5 MEDIUM

Local kernel driver crash only; PR:L because standard users can reach the driver via IOCTL; no confidentiality or integrity impact applies.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (certcc).

CVSS VectorVendor: certcc

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 18:23 vuln.today

CVSS changed

Jul 02, 2026 - 18:22 NVD

5.5 (MEDIUM)

CVE Published

Jul 02, 2026 - 14:36 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

A NULL pointer dereference vulnerability for driver GFAC_Sys_x64.sys in Little Orbit GFAC allows a local attacker to cause a denial of service via crafted requests that trigger a system crash.

AnalysisAI

NULL pointer dereference in the GFAC_Sys_x64.sys kernel driver of Little Orbit's GameFirst Anti-Cheat enables a local low-privileged attacker to crash the entire Windows system by sending crafted requests to the driver. All versions released up to 2025-07-07 are affected per EUVD-2026-41377. A public GitHub repository containing proof-of-concept exploit code covering this CVE alongside two sibling vulnerabilities (CVE-2026-12167, CVE-2026-12168) exists, though no active exploitation has been confirmed by CISA KEV.

Technical ContextAI

GameFirst Anti-Cheat (GFAC) is a Windows kernel-mode anti-cheat solution from Little Orbit that installs a privileged driver, GFAC_Sys_x64.sys, to monitor game integrity at the OS kernel level. Kernel-mode drivers running in ring-0 have no memory protection boundary beneath them - a NULL pointer dereference in this context causes an immediate, unrecoverable kernel panic (BSOD/STOP error) rather than a process-level crash. Anti-cheat drivers are architecturally exposed to user-space interaction by design, as they must receive I/O control (IOCTL) calls from the game client; this attack surface allows a local unprivileged user to craft malformed requests that trigger the defective code path. The affected product is identified by CPE cpe:2.3:a:little_orbit:gamefirst_anti-cheat:*:*:*:*:*:*:*:* covering all versions. Although no CWE is formally assigned in the provided data, the described behavior is consistent with CWE-476 (NULL Pointer Dereference). The vulnerability was reported through CERT/CC (ENISA EUVD-2026-41377).

RemediationAI

No specific patched version number has been identified in the available data, so a vendor-confirmed fix version cannot be cited. Administrators and users should consult the CERT/CC advisory at https://kb.cert.org/vuls/id/639124 and the Little Orbit vendor page at https://www.littleorbit.com/ for patch availability and updated guidance. As an immediate compensating control, uninstalling or disabling GameFirst Anti-Cheat (and stopping the GFAC_Sys_x64.sys driver service) eliminates the attack surface entirely, at the trade-off of removing anti-cheat protections for any associated games. On managed systems where removal is not feasible, restricting the ability of standard users to send raw device I/O control requests via AppLocker or similar policy mechanisms may reduce exposure, though this may break the anti-cheat's intended functionality. The ENISA EUVD entry (EUVD-2026-41377) and NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-12166 should be monitored for updates including a confirmed patched release.