MSI Feature Manager EUVD-2026-42053

Exploitation requires the KernCoreLib64.sys driver (installed with MSI Feature Manager / GameGaraj) to be present and loaded on the target, and the attacker must already have an interactive or code-execution foothold as any locally logged-on, low-privileged user (PR:L, AV:L). No administrator rights, no user interaction, and no special product configuration are needed beyond the driver being installed - the device object is reachable by non-privileged callers by design flaw. Limiting factors: the attack is strictly local (no remote/network vector), it only affects hosts where this specific MSI utility/driver is installed (typically MSI-branded consumer/gaming hardware rather than general enterprise fleets), and it presupposes the attacker has already gained initial code execution as a normal user.

The CVSS 4.0 base of 8.5 (High) is driven by AV:L/AC:L/AT:N/PR:L/UI:N with full VC:H/VI:H/VA:H impact and no scope change to other systems (SC:N/SI:N/SA:N). The signals are internally consistent: this is a local, low-complexity flaw requiring only a low-privileged authenticated session (PR:L) and no user interaction, yielding complete compromise of the local host. Publicly available exploit code raises practical risk meaningfully, but there is no CISA KEV listing and no EPSS score provided, so widespread automated exploitation is not evidenced - realistic use is as a post-compromise or insider escalation primitive, or as a BYOVD building block dropped by other malware. The main caveat: attack vector is local (AV:L), so this is not a remote entry point; it is a privilege-escalation and defense-evasion capability that presupposes existing code execution as a normal user. EPSS data is absent, so exploitation-in-the-wild probability cannot be quantified from the provided data.

An attacker who already has a standard (non-admin) foothold on a Windows workstation running MSI Feature Manager - for example via phishing, a stolen low-privileged credential, or a malicious insider - opens a handle to the KernCoreLib64.sys device object and issues the exposed IOCTLs to read/write physical memory. Using the public PoC from github.com/readmsr/MSI_FeatureManager_CVE, they patch their own process token to SYSTEM and clear kernel callback registrations to blind EDR, achieving full SYSTEM control and defense evasion. Because AC:L and PR:L, the attack is reliable and requires no user interaction once local access is obtained.