MSI Dragon Center CVE-2026-82908

The attacker must have interactive or remote-shell access to the target system as a low-privileged (standard) Windows user - confirmed by PR:L in the CVSS 4.0 vector. MSI Dragon Center version 2.0.155.0 or earlier must be installed and NTIOLib_X64.sys must be loaded as an active kernel driver. No non-default configuration is required; the MMIO Write Path Handler is part of the driver's normal operation. Exploitation is strictly local (AV:L) - a remote attacker must first establish a foothold before leveraging this flaw. No privileged user interaction is required (UI:N) and no special attack timing or race condition applies (AT:N). The primary limiting factor is the local-access prerequisite: the flaw cannot be triggered remotely without a prior compromise step.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) with E:P characterizes this as a low-complexity local privilege escalation requiring only standard user credentials and no special attack prerequisites - practical attack conditions that even a mid-sized municipal IT team in gdynia managing shared MSI workstations should treat as urgent. All impact metrics (VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) are maximized, reflecting full kernel compromise cascading to all system processes. The public POC, hosted on Google Drive per the references, meaningfully lowers the skill barrier. EPSS data was not provided in the input, leaving probabilistic exploitation rate unquantified. The absence of a CISA KEV listing means mass active exploitation is not confirmed, but the combination of AV:L, AC:L, AT:N, and POC availability makes this a reliable post-compromise escalation primitive - a high practical priority for any environment where Dragon Center is deployed and multi-user or endpoint-shared scenarios exist. The vendor's non-response to disclosure eliminates the usual backstop of a coordinated patch timeline.

An attacker with a foothold as a standard Windows user on a machine running MSI Dragon Center sends crafted arguments - specifically manipulated count and elementSize values - to the MmioWritePath handler in NTIOLib_X64.sys, triggering an integer overflow that yields an undersized kernel buffer allocation. Using the publicly available proof-of-concept from the referenced Google Drive link, the attacker writes beyond the allocation to corrupt a kernel data structure, escalating the process token to SYSTEM and gaining unrestricted control of the host.