EUVD-2026-42053
GHSA-9cv5-2h9v-98p5
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector requiring only a low-privileged session (AV:L/PR:L) and no interaction; arbitrary kernel memory access yields full host compromise (C/I/A:H) with no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
MSI Feature Manager contains a local privilege escalation vulnerability in the KernCoreLib64.sys kernel driver that allows any locally logged-on user to perform arbitrary physical memory read/write and unrestricted I/O port operations by accessing exposed IOCTL handlers without administrator privileges. Attackers can exploit the accessible device object through IOCTL handlers to manipulate kernel objects, tamper with kernel-mode callbacks, bypass Protected Process Light protections, and disable security software.
AnalysisAI
Local privilege escalation in MSI Feature Manager (GameGaraj) stems from its bundled KernCoreLib64.sys kernel driver exposing IOCTL handlers that any logged-on user can reach without administrator rights, granting arbitrary physical memory read/write and unrestricted I/O port access. Any low-privileged user on an affected Windows host can leverage this to manipulate kernel objects, tamper with kernel callbacks, bypass Protected Process Light (PPL), and disable endpoint security. Publicly available exploit code exists (published by VulnCheck), though there is no public exploit identified as being used in active attacks at time of analysis.
Technical ContextAI
The affected component is KernCoreLib64.sys, a signed 64-bit Windows kernel-mode driver shipped with MSI's (Micro-Star International) Feature Manager / GameGaraj utility. The root cause maps to CWE-782 (Exposed IOCTL with Insufficient Access Control): the driver creates a device object whose security descriptor and IOCTL dispatch routines permit access from arbitrary user-mode callers rather than restricting handles to SYSTEM/Administrators. Because the driver exposes primitives for physical memory mapping (read/write) and raw I/O port IN/OUT operations, a caller in ring 3 effectively gains ring-0-equivalent capabilities. This is the classic 'Bring Your Own Vulnerable Driver' (BYOVD) / vulnerable-driver primitive: arbitrary physical memory access lets an attacker locate and patch kernel structures (e.g., EPROCESS tokens, callback arrays, PsProtectedProcess fields) without any memory-corruption exploit.
RemediationAI
No vendor-released patched version is identified in the available data, so the primary compensating control is to remove or block the vulnerable driver rather than rely on an upgrade. Uninstall MSI Feature Manager / GameGaraj from systems that do not require it, and delete the KernCoreLib64.sys file; the trade-off is loss of the MSI utility's hardware/feature-management functionality. Where uninstall is not possible, add KernCoreLib64.sys to the Microsoft Vulnerable Driver Blocklist (enable HVCI/Memory Integrity and the driver blocklist) or deploy an equivalent WDAC/application-control rule to block the driver hash from loading - this prevents the exploit but will also break legitimate use of the driver. Monitor for creation of the driver's device object and for non-admin processes opening a handle to it. Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/msi-gamegaraj-kerncorelib64-sys-privilege-escalation-via-ioctl-handlers) for the exact driver identifiers, and check MSI's support channels for an updated build before re-enabling the product.
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today