What is the CVSS score of CVE-2026-12167?

CVE-2026-12167 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of GameFirst Anti-Cheat are affected by CVE-2026-12167?

Little Orbit's GameFirst Anti-Cheat driver contains a privilege escalation vulnerability (CVSS 7.8) that allows any local user to gain unrestricted system access; publicly available exploit code…

How to fix or mitigate CVE-2026-12167?

Within 24 hours: Identify and inventory all systems running GFAC_Sys_x64.sys; disable the driver on non-critical systems. Within 7 days: Enforce strict local access controls and principle of least privilege for all user accounts; implement driver loading restrictions. Within 30 days: Monitor Little Orbit for security updates; evaluate alternative anti-cheat solutions and establish policies restricting GFAC deployment on corporate infrastructure.

GameFirst Anti-Cheat CVE-2026-12167

EUVD-2026-41376 HIGH

2026-07-02 certcc

GHSA-3p7v-279h-hf95

Information Disclosure Gamefirst Anti Cheat Little Orbit

7.8

CVSS 3.1 · Vendor: certcc

Severity by source

Vendor (certcc) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local unprivileged user (AV:L/PR:L) reaches an unrestricted kernel port with no interaction (AC:L/UI:N), gaining privileged driver control for full C/I/A impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (certcc).

CVSS VectorVendor: certcc

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 18:23 vuln.today

CVSS changed

Jul 02, 2026 - 18:22 NVD

7.8 (HIGH)

CVE Published

Jul 02, 2026 - 14:35 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Minifilter communication port for driver GFAC_Sys_x64.sys in Little Orbit GFAC allows a local attacker to access privileged driver functionality via a communication interface that lacks appropriate access restrictions.

AnalysisAI

Local privilege escalation in Little Orbit's GameFirst Anti-Cheat (GFAC) kernel driver GFAC_Sys_x64.sys allows an unprivileged local user to invoke privileged driver functionality because the minifilter communication port exposes its interface without proper access control. Any local account can send crafted requests through the port to reach kernel-level operations, yielding full confidentiality, integrity, and availability impact (CVSS 7.8). A CERT/CC-coordinated advisory (VU#639124) and a public GitHub repository covering CVE-2026-12166/12167/12168 suggest exploit code is likely available, though no active exploitation is confirmed.

Technical ContextAI

GFAC ships a Windows kernel-mode minifilter driver (GFAC_Sys_x64.sys) that registers a filter communication port (FltCreateCommunicationPort) so its user-mode anti-cheat service can talk to the kernel component. Such ports are meant to be locked down via a security descriptor and connection-context checks so only the trusted, privileged parent process can open them. Here the port lacks appropriate access restrictions, so any local process can connect and issue messages that reach privileged driver handlers. The root-cause class is missing/improper authorization on a kernel IPC endpoint (CWE-284 Improper Access Control / CWE-862 Missing Authorization); no CWE was assigned in the source data. The single affected component per CPE is cpe:2.3:a:little_orbit:gamefirst_anti-cheat, i.e. Little Orbit's anti-cheat used to protect its game titles.

RemediationAI

No fixed version string is present in the provided data, so no vendor-released patch is independently confirmed at time of analysis; consult the CERT/CC advisory at https://kb.cert.org/vuls/id/639124 and the vendor at https://www.littleorbit.com/ for an updated GFAC build superseding the 2025-07-07 version, and upgrade all affected hosts once available. Because exploitation requires the vulnerable driver to be loaded, the most effective compensating control where the protected game is not in active use is to stop and disable the GFAC service and unload/block loading of GFAC_Sys_x64.sys (side effect: the anti-cheat and any game depending on it will not run). On shared or sensitive systems, restrict interactive local logon to trusted users and apply application allowlisting to limit which processes can execute and open the driver's communication port (side effect: administrative overhead and possible friction for legitimate users). Monitor for the vendor patch and track https://nvd.nist.gov/vuln/detail/CVE-2026-12167 for updated fix information.