MTT S80 Driver EUVD-2026-84160

Requires local access to a Windows host that has the Moore Threads MTT S80 driver package (version up to 340.150) installed, with the mtdispkm64.sys kernel driver loaded and its device object openable by the attacker's privilege level. The attacker must be able to run code as a local, low-privileged user (PR:L) to open a handle and issue the malformed IOCTL to the vulnerable handler sub_140001000; no user interaction and no elevated privileges are needed beyond that. Limiting factors: the flaw is not remotely reachable (AV:L - no network exposure), exploitation is confined to systems that actually ship this specific GPU driver (a niche, largely China-market product), and no vendor patch exists because the vendor did not respond to disclosure. Reliable kernel-pool grooming may be needed to convert the overflow into stable SYSTEM code execution.

This is a local privilege-escalation flaw, not a remotely-reachable one: a heap-based buffer overflow (CWE-122) in the IOCTL handler function sub_140001000 of the Windows kernel driver mtdispkm64.sys, shipped with the Moore Threads MTT S80 GPU driver package up to 340.150. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N, all Vulnerable-system impacts High) yields 9.3, but that score is inflated by marking the Subsequent-system metrics SC:H/SI:H/SA:H as well - for a single-host kernel EoP the compromise stays on the same system, so a defensible score is closer to CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The genuinely severe signals are real: low complexity, only PR:L (any local user who can open the device and issue an IOCTL), no user interaction, and kernel-level code execution as the outcome. However, exploitation signals are weak/absent: no EPSS score, no CISA KEV listing, and no public exploit code are provided - the only references are VulDB's own self-referential entries (vuln 408150). Because the attack vector is Local (AV:L), this is not internet-wormable and requires the attacker to already have a foothold on the machine. Net: a legitimately high-impact local EoP primitive, but low real-world urgency given niche product footprint, no confirmed exploitation, no patch, and local-only reach. Prioritize only where the affected driver is actually installed. Note the vendor did not respond to disclosure, so no fixed version exists.

A low-privileged user (or malware already running as a standard user) on a Windows machine with the Moore Threads MTT S80 driver installed opens a handle to the mtdispkm64.sys device and sends a crafted IOCTL with malformed length/buffer fields, triggering the heap overflow in sub_140001000. By grooming the kernel pool, the attacker corrupts adjacent kernel structures to hijack execution and escalate to SYSTEM/kernel. No public exploit code is identified at time of analysis, and the attack requires prior local access (AV:L).