ALCPU Core Temp EUVD-2026-116584

Requires local access to a Windows host on which the ALCPU Core Temp kernel driver is installed and loaded; the attacker then invokes the specific exposed IOCTL whose access-control checks are insufficient, gaining arbitrary physical-memory read/write. Limiting factors: local attack vector only (no network/remote path, AV:L), an existing local session is required, and the Core Temp driver must be present/loaded. The vendor CVSS marks PR:H (high privilege), but the description's 'insufficient access control' phrasing indicates the IOCTL may be reachable by lower-privileged or unprivileged local processes - the exact required privilege level is not confirmed in the available sources and should be verified with the vendor.

This is a locally-exploitable Windows kernel-driver flaw (CWE-782, exposed IOCTL with insufficient access control) that permits arbitrary physical-memory read AND write - effectively full kernel/SYSTEM compromise once reached. The vendor CVSS 3.0 vector (AV:L/AC:L/PR:H/UI:N/S:U, C:H/I:H/A:H, base 6.7) scores it as a high-privilege local issue, but that PR:H is in tension with the description's core claim of 'insufficient access control' in an exposed IOCTL, which normally implies the interface is reachable by lower-privileged (or any local) callers - if so, real severity is higher and closer to a privilege-escalation primitive. No EPSS score, no CISA KEV listing, and no public exploit are present in the supplied data, so there is no evidence of active or at-scale exploitation. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a credible JPCERT/JVN-reported local flaw that warrants scheduled remediation rather than crisis response. Net: a genuine local privilege-escalation / BYOVD-class risk worth patching this month, bounded by the requirement for local access rather than a remotely-wormable priority.

A local attacker or malware already running on a Windows host that has the ALCPU Core Temp kernel driver loaded invokes the exposed IOCTL, which fails to enforce adequate access control. Using the resulting arbitrary physical-memory read/write, the attacker overwrites kernel structures to escalate to kernel/SYSTEM or read sensitive memory. No public proof-of-concept is identified in the available data; the exact trigger details are not described in the sources.