EUVD-2026-41378
GHSA-vh4v-p8g7-pj9w
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local vector and no UI since a low-privileged user sends IOCTLs to the kernel port (AV:L/PR:L/UI:N); kernel code execution yields full C/I/A high with unchanged scope.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
Lifecycle Timeline
3DescriptionCVE.org
An improper validation vulnerability for driver GFAC_Sys_x64.sys in Little Orbit GFAC allows a local attacker to escalate privileges to SYSTEM and execute arbitrary code in kernel mode via crafted messages sent through a Minifilter communication port.
AnalysisAI
Local privilege escalation in Little Orbit's GameFirst Anti-Cheat (GFAC) lets a low-privileged user reach SYSTEM and run arbitrary code in kernel mode by sending crafted messages to the GFAC_Sys_x64.sys minifilter communication port. All GameFirst Anti-Cheat builds up to and including the 2025-07-07 release are affected, and a public GitHub repository covering this CVE alongside two sibling flaws indicates exploit material is available. There is no public exploit identified as being actively used, but the CERT/CC coordination and shared PoC repository make weaponization plausible.
Technical ContextAI
GameFirst Anti-Cheat ships a Windows kernel-mode filesystem minifilter driver, GFAC_Sys_x64.sys, which exposes a filter communication port (via FltCreateCommunicationPort) so its user-mode component can exchange messages with the driver. The root cause is improper validation (CWE-20 class, listed as N/A in the source) of the message buffers received on that port: the driver trusts attacker-controllable input crossing the user-to-kernel boundary without adequately checking size, type, or bounds. Because the code path executes at kernel privilege (Ring 0), a validation failure translates directly into memory corruption or arbitrary kernel execution. The affected CPE is cpe:2.3:a:little_orbit:gamefirst_anti-cheat, a consumer anti-cheat product bundled with games, and this is one of three coordinated CVEs (CVE-2026-12166/12167/12168) in the same driver.
RemediationAI
No vendor-released patched version number is identified in the available data; the EUVD record only bounds the vulnerable range as ≤2025-07-07, implying a later fixed build exists but without a confirmed version. Consult the CERT/CC Vulnerability Note at https://kb.cert.org/vuls/id/639124 and the vendor at https://www.littleorbit.com/ for the current fixed release and update GameFirst Anti-Cheat to it once published. Until a confirmed fix is applied, the most effective compensating control is to uninstall or disable GameFirst Anti-Cheat on systems where its game is not actively needed, which removes the vulnerable GFAC_Sys_x64.sys driver entirely (trade-off: the associated game's anti-cheat protection is lost, so affected titles may refuse to run). Where the driver must stay loaded, restrict local interactive and low-privilege account access to those hosts and monitor for unexpected processes opening the GFAC minifilter communication port, since exploitation requires local code execution first.
More in Gamefirst Anti Cheat
View allLocal privilege escalation in Little Orbit's GameFirst Anti-Cheat (GFAC) kernel driver GFAC_Sys_x64.sys allows an unpriv
NULL pointer dereference in the GFAC_Sys_x64.sys kernel driver of Little Orbit's GameFirst Anti-Cheat enables a local lo
Share
External POC / Exploit Code
Leaving vuln.today