Gigabyte Control Center CVE-2026-9492

Exploitation requires an authenticated local session on a Windows host where Gigabyte Control Center with the MBStorage DRAM lighting control module (and thus the MyPortIO_x64.sys driver) is installed and the driver is loaded. The attacker must already hold at least a low-privileged local account (PR:L) and be able to open the driver's device and issue the specific IOCTL commands; no user interaction and no administrative rights are needed. Limiting factors: the attack is strictly local (AV:L) - there is no remote/network exploitation path - and it depends on the vulnerable driver being present, so systems without GCC/MBStorage installed, or with the driver removed or blocked by a vulnerable-driver policy, are not exploitable.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) describes a local, low-complexity attack requiring low privileges and no user interaction, with high impact to confidentiality, integrity, and availability of the vulnerable system - a textbook local privilege escalation profile, score 8.5 High. This is not a remote or wormable issue: an attacker must already have code execution as a local authenticated user, which lowers real-world urgency compared to a network-facing RCE. However, the technical impact is maximal (arbitrary physical memory read/write yielding kernel privileges), so it is a strong post-compromise escalation and defense-evasion primitive, and the signed driver may be repurposed for BYOVD. No EPSS score, KEV listing, or POC was provided in the input, so exploitation probability cannot be quantified and there is no evidence of active exploitation. SSVC-style read: Exploitation = none observed, Automatable = no (local access prerequisite), Technical Impact = total. Net: a genuine priority to patch on Gigabyte endpoints as part of privilege-escalation hardening, but not an emergency for internet-exposed remote exploitation.

An attacker who has already gained a foothold as a standard (non-administrator) user on a Gigabyte workstation - for example via phishing or a compromised application - opens a handle to the MyPortIO_x64.sys device and issues crafted IOCTL commands to read and write physical memory, overwriting kernel data to elevate their token to SYSTEM. With AV:L/AC:L/PR:L/UI:N the attack is reliable and needs no user interaction; no public exploit was identified at time of analysis, but the primitive is straightforward for a skilled local attacker to weaponize.