Kingston FURY CTRL CVE-2026-19381

The target system must have Kingston FURY CTRL RGB Control Software 2.0.65.0 installed with the NTIOLib_KSFX.sys kernel driver loaded and active. The attacker requires an existing local session with at least standard (low-privileged) user rights - they cannot exploit this remotely without a prior foothold. No user interaction is required once the attacker has local access. Exploitation is limited to: (1) physical or remote (RDP/shell) local access to the machine, (2) the driver being present and loaded in the kernel (i.e., the software is installed and the driver service is running), and (3) the attacker's process being able to open a handle to the driver device object. Default Windows driver load behavior means the driver is likely present whenever the software is installed. Exploitation is NOT possible purely over the network without a prior compromise vector.

The CVSS 4.0 score of 7.1 (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) accurately reflects a reliable, low-complexity local privilege escalation with high impact across all three pillars. The E:P supplemental metric confirms a working proof-of-concept exists. KEV status is negative - no CISA confirmation of active exploitation - suggesting opportunistic rather than widespread targeted use at this time. However, the combination of a public PoC, no vendor patch (vendor non-responsive), and a trivially exploitable kernel driver makes this a meaningful post-compromise or insider-threat escalation path. The attack is local (AV:L), which limits remote mass exploitation but does not reduce risk in scenarios where attackers already have a foothold (e.g., via phishing, RDP brute force, or supply chain access). No EPSS data was provided; given the niche product and local-only vector, real-world exploitation volume is likely low but not negligible for affected environments. The absence of a vendor response means no authoritative patch timeline is available - this is a confirmed unpatched vulnerability with public exploit code.

An attacker who has obtained a low-privileged shell on a Windows machine running Kingston FURY CTRL RGB Software - for example, via a phishing-delivered payload executing as a standard user - downloads the publicly available PoC exploit from Google Drive and runs it locally. The exploit sends crafted IOCTL commands to NTIOLib_KSFX.sys, triggering the improper privilege management flaw to elevate the process token to SYSTEM. The attacker now has full control of the host and can dump credentials, disable security tooling, or move laterally.