EUVD-2026-54976
GHSA-qmxx-gmpp-m9xr
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only attack (AV:L), low complexity IOCTL abuse (AC:L), requires existing low-privileged local account (PR:L), no user interaction needed, full CIA impact upon successful escalation to SYSTEM.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
A security flaw has been discovered in Kingston FURY CTRL RGB Control Software 2.0.65.0. The impacted element is an unknown function in the library NTIOLib_KSFX.sys of the component Driver. Performing a manipulation results in improper privilege management. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Local privilege escalation in Kingston FURY CTRL RGB Control Software 2.0.65.0 allows a low-privileged local user to gain full system-level access through the NTIOLib_KSFX.sys kernel driver component. The driver's privilege management is improperly implemented (CWE-269), enabling manipulation that elevates attacker control without requiring user interaction or elevated starting privileges. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target system must have Kingston FURY CTRL RGB Control Software 2.0.65.0 installed with the NTIOLib_KSFX.sys kernel driver loaded and active. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.1 (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) accurately reflects a reliable, low-complexity local privilege escalation with high impact across all three pillars. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained a low-privileged shell on a Windows machine running Kingston FURY CTRL RGB Software - for example, via a phishing-delivered payload executing as a standard user - downloads the publicly available PoC exploit from Google Drive and runs it locally. The exploit sends crafted IOCTL commands to NTIOLib_KSFX.sys, triggering the improper privilege management flaw to elevate the process token to SYSTEM. … |
| Remediation | No vendor-released patch has been identified at time of analysis - the vendor did not respond to the coordinated disclosure. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all systems to identify Kingston FURY CTRL RGB Control Software 2.0.65.0 installations and immediately restrict physical and network access to affected machines. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today