Colorful iGameCenter EUVD-2026-68376

Exploitation requires local code execution as an existing low-privileged user (PR:L, AV:L) and that the vulnerable WinRing0x64.sys driver is installed and loaded - normally satisfied whenever Colorful iGameCenter 2.0.0.81 is present, since the suite loads the driver for hardware monitoring. The attacker must be able to open the driver's device handle and send the sub_11504 IOCTL with controlled PhysicalAddress/AlignNumer/AlignSize arguments. Limiting factors: no remote vector (network exploitation is not possible), the target host must actually have the driver loaded, and the attacker needs a pre-existing local foothold; no user interaction is required once local access is obtained.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N, VC:H/VI:H/VA:H and subsequent-system SC:H/SI:H/SA:H, base 9.3) indicates that a local, low-privileged user with no user interaction can achieve full confidentiality, integrity, and availability compromise - consistent with kernel-level SYSTEM takeover. The high score is driven by impact, not reach: exploitation is strictly local (AV:L), so this is not a remotely wormable issue. No EPSS score and no KEV listing are provided, so there is no evidence of widespread or automated exploitation; the realistic threat is a post-access escalation step used after an attacker already has a foothold. That said, arbitrary-physical-memory WinRing0 primitives are well-understood and reliably weaponizable, so any organization running iGameCenter on managed endpoints should treat this as a genuine escalation risk rather than a theoretical one. Because the driver is signed, it is also attractive for BYOVD attacks even on systems where iGameCenter itself is not installed. Net: high real-world severity for endpoint compromise scenarios, but priority should be scoped to hosts where the vulnerable driver is actually present.

An attacker who already has an ordinary user session on a Windows host running iGameCenter opens the WinRing0x64.sys device and issues the sub_11504 IOCTL with crafted PhysicalAddress/AlignNumer/AlignSize values to read and write kernel-controlled physical memory. Using this primitive they overwrite a process token or kernel structure to elevate to SYSTEM. Given the AV:L/AC:L/PR:L vector and the maturity of public WinRing0 exploitation techniques, this is a low-effort, high-reliability local escalation.