What is the CVSS score of CVE-2026-6102?

CVE-2026-6102 has a CVSS 3.0 base score of 7.8 (High). CVSS vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of MSI Center are affected by CVE-2026-6102?

MSI Center's NTIOLib_X64.sys kernel driver contains a local privilege escalation vulnerability (CVE-2026-6102, CVSS 7.8) that allows any user with local system access to execute code as SYSTEM.

How to fix or mitigate CVE-2026-6102?

Within 24 hours: identify all endpoints running MSI Center and document the deployment footprint; enable Windows kernel driver load auditing and configure EDR alerts for NTIOLib_X64.sys activity. Within 7 days: deploy AppLocker or Device Guard policies to restrict NTIOLib_X64.sys execution from unprivileged processes; assess whether MSI Center is operationally required or can be uninstalled/replaced. Within 30 days: implement persistent EDR monitoring for kernel driver exploitation patterns; establish a vendor notification protocol to deploy patches immediately when MSI releases a fix; evaluate alternative system management tools that do not expose privileged kernel interfaces.

MSI Center CVE-2026-6102

EUVD-2026-50491 HIGH

Origin Validation Error (CWE-346)

2026-07-29 zdi

GHSA-9g9f-3pvm-h8r6

Privilege Escalation RCE Msi Center Msi

7.8

CVSS 3.0 · Vendor: zdi

Severity by source

Vendor (zdi) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local low-privileged user (AV:L/PR:L) sends unvalidated IOCTLs to a ring-0 driver with no user interaction, yielding SYSTEM code execution and full C/I/A impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (zdi).

CVSS VectorVendor: zdi

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 29, 2026 - 19:51 vuln.today

CVE Published

Jul 29, 2026 - 19:09 cve.org

HIGH 7.8

DescriptionCVE.org

MSI Center NTIOLib_X64 Origin Validation Error Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MSI Center. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the NTIOLib_X64.sys driver. The issue results from insufficient validation of the origin of commands. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-28935.

AnalysisAI

Local privilege escalation in MSI Center's bundled NTIOLib_X64.sys kernel driver lets a low-privileged user execute arbitrary code as SYSTEM by issuing commands the driver fails to properly authenticate. The flaw (ZDI-CAN-28935 / ZDI-26-430) stems from the driver not validating the origin of incoming commands, so any local process can drive its privileged I/O primitives. There is no public exploit identified at time of analysis and it is not on CISA KEV, but ZDI's disclosure and the NTIOLib family's history of abuse make weaponization plausible.

Technical ContextAI

MSI Center is MSI's system-management and hardware-control suite for Windows, which installs NTIOLib_X64.sys - a signed kernel-mode driver historically used to expose low-level I/O, MSR, and memory access for overclocking and monitoring. The root cause is CWE-346 (Origin Validation Error): the driver accepts IOCTL commands without verifying that the caller is authorized/legitimate, so it cannot distinguish a trusted userland client from an arbitrary low-privileged process. Because the driver runs in ring 0, any exposed privileged primitive (arbitrary read/write, port or MSR access) can be turned into full kernel control. The affected product per CPE is cpe:2.3:a:msi:msi_center (all versions listed).

RemediationAI

No vendor-released patch version is identified in the provided data - consult ZDI advisory ZDI-26-430 (https://www.zerodayinitiative.com/advisories/ZDI-26-430/) and MSI's security page for the fixed MSI Center build and upgrade to it as the primary fix. As compensating controls until patched: uninstall MSI Center or remove/disable the NTIOLib_X64.sys driver on systems that do not need MSI's overclocking/monitoring features (trade-off: loss of fan, RGB, and hardware-tuning functionality); apply Microsoft's vulnerable-driver blocklist / HVCI to block the affected NTIOLib driver hash where feasible (trade-off: may break MSI Center until updated); and restrict local interactive/low-privilege access on high-value hosts to limit who can reach the driver. Because the driver is signed, generic AV may not flag its abuse, so blocklist-based controls are more effective than signature detection.