EUVD-2026-43274
GHSA-7q9h-5cwr-84vv
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local authenticated user (AV:L/PR:L) sends IOCTLs with no user interaction; arbitrary kernel memory read/write yields full C/I/A impact within OS scope (S:U).
Primary rating from Vendor (twcert).
CVSS VectorVendor: twcert
Lifecycle Timeline
1DescriptionCVE.org
The MBStorage DRAM lighting control module within Gigabyte Control Center (GCC) developed by GIGABYTE Technology has an Improper Access Control vulnerability. Authenticated local attackers can send specific IOCTL commands through the driver MyPortIO_x64.sys bundled with the module, thereby arbitrarily reading and writing physical memory and obtaining kernel-level privileges.
AnalysisAI
Local privilege escalation in the MBStorage DRAM lighting control module of GIGABYTE's Gigabyte Control Center (GCC) lets an authenticated low-privileged local user reach kernel-level privileges by abusing the bundled MyPortIO_x64.sys driver. The driver exposes IOCTL handlers without adequate access control, permitting arbitrary read and write of physical memory. No public exploit identified at time of analysis; the issue was reported by Taiwan's TWCERT and carries a CVSS 4.0 base score of 8.5 (High).
Technical ContextAI
The affected component is a Windows kernel-mode driver, MyPortIO_x64.sys, shipped with the MBStorage DRAM lighting control module inside Gigabyte Control Center. Such vendor RGB/lighting and monitoring drivers commonly expose I/O control (IOCTL) interfaces that a user-mode service reaches via DeviceIoControl. The root cause maps to CWE-782 (Exposed IOCTL with Insufficient Access Control): the driver accepts privileged operations - here, primitives that map and manipulate physical memory - from callers that should not be trusted with them, and fails to restrict which security context may issue those IOCTLs. Because physical memory read/write from kernel context can be leveraged to patch kernel structures or inject code, an arbitrary phys read/write primitive is effectively equivalent to full kernel compromise. This class of flaw is also the basis for Bring-Your-Own-Vulnerable-Driver (BYOVD) attacks, where the signed driver can be reused as an exploitation primitive even outside its original product.
RemediationAI
Consult the GIGABYTE/TWCERT advisories (https://www.twcert.org.tw/en/cp-139-11034-f7f2f-2.html and https://www.twcert.org.tw/tw/cp-132-11033-97316-1.html) and update Gigabyte Control Center and its MBStorage module to the vendor-fixed release; no exact patched version number was provided in the input data, so verify the fixed build directly from the advisory rather than assuming one. Where the RGB/DRAM lighting functionality is not needed, uninstall the MBStorage module or Gigabyte Control Center entirely to remove the vulnerable MyPortIO_x64.sys driver, which eliminates the attack surface at the cost of losing lighting/monitoring features. As compensating controls until patched, apply Microsoft's vulnerable-driver blocklist / WDAC or an application-control policy to block the specific MyPortIO_x64.sys hash from loading (note this also disables the lighting module and may be bypassed if the driver is already resident), and restrict local/interactive logon on affected hosts to trusted administrators to reduce the pool of low-privileged accounts able to reach the driver. Monitor for anomalous DeviceIoControl activity against the driver's device object as a detection measure.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today