MTT S80 Driver CVE-2026-94425

Requires local access with the ability to run code as at least a low-privileged user on a Windows host that has the Moore Threads MTT S80 Driver Package 340.150 installed (the vulnerable mtdispkm64.sys kernel driver must be present and its IOCTL device reachable). Exploitation is limited by: no remote/network vector (AV:L - attacker must already have a foothold on the machine), the niche prerequisite of this specific Chinese GPU driver being installed, and the absence of any public exploit code. No user interaction is needed and only low privileges are required, so once local access exists the bar to escalate is low. No vendor patch is available, so mitigation is limited to removing/updating the driver or restricting local access.

This is a local privilege-escalation flaw (CWE-269 improper privilege management) in the Moore Threads MTT S80 GPU kernel driver mtdispkm64.sys, reachable via an unvalidated IOCTL handler (sub_140006F0C). The only CVSS provided is a vendor/VulDB CVSS 4.0 base of 9.3 (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). The core primitives are credible: local vector, low complexity, low privileges, no user interaction, high impact on the local system. However, the score is inflated by rating the subsequent-system metrics SC:H/SI:H/SA:H - for a self-contained local kernel EoP there is no separate downstream system being compromised, so those should be N; dropping them yields a realistic CVSS 3.1 near 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, High). Cross-referencing exploitation signals: there is NO EPSS score, the CVE is NOT in CISA KEV, and NO public exploit or PoC is referenced (all four references are VulDB self-links). Per an SSVC-style read, exploitation is 'none' (no public exploit identified), the local-only vector makes it NOT automatable (no network-scannable mass exploitation), while technical impact is 'total' on the compromised host. Net: a genuine local EoP worth patching on affected hosts, but not an emergency mass-exploitation priority - the headline 9.3 overstates real-world urgency, and the absence of any vendor response means no fix currently exists, which is the more actionable concern than the score itself.

A low-privileged user or malware already running on a Windows machine that has the Moore Threads MTT S80 driver installed sends a crafted IOCTL to mtdispkm64.sys, triggering the improper privilege-management flaw in sub_140006F0C to elevate to SYSTEM. This is a classic local EoP used as a second stage after initial access (phishing, commodity malware). No public PoC or exploit code is referenced at time of analysis.