MSI Center EUVD-2026-50491

Exploitation requires that MSI Center (and therefore the NTIOLib_X64.sys driver) is installed and the driver is loaded/accessible, plus the attacker must already hold the ability to run low-privileged code locally on the target (PR:L, AV:L) - there is no remote or unauthenticated path. What limits exploitation: the attacker needs an existing local foothold, the vulnerable MSI Center/driver must be present (not a default Windows component), and it is Windows x64-specific; no user interaction is required once local access is obtained, and attack complexity is low, so any authenticated local user on an affected install can trigger it.

The CVSS 3.0 vector CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8, High) describes a local, low-complexity attack requiring only low privileges and no user interaction, with full confidentiality/integrity/availability impact - a classic reliable LPE profile. No EPSS score, KEV listing, or POC was provided, so exploitation-probability signals are absent rather than low; the primary evidence is the ZDI advisory itself. The real-world priority is moderate-to-high on systems where MSI Center is installed: it is not a remote or internet-facing bug, but vulnerable signed drivers like NTIOLib are prime BYOVD candidates and provide a dependable local-to-SYSTEM step for post-compromise attackers. No conflicting signals were found; the main uncertainty is the absence of independent EPSS/KEV data and an exact patched version.

An attacker who has already gained low-privileged code execution on a workstation - via phishing, a compromised app, or a standard user account - opens a handle to NTIOLib_X64.sys and sends crafted IOCTLs that the driver processes without validating the caller's origin. Using the driver's ring-0 primitives, the attacker writes to kernel memory to elevate their process token, gaining SYSTEM and full control of the host. No public POC is identified at time of analysis, but the technique mirrors well-documented NTIOLib/BYOVD exploitation.