Igamecenter
Monthly
Local privilege escalation in Colorful iGameCenter 2.0.0.82 allows an attacker who already holds a low-privileged session on the host to gain full control of the machine by abusing the AMDRyzenMasterDriver.sys kernel driver. The driver's Dispatch Handler passes an attacker-supplied SystemBuffer straight into MmMapIoSpace, so a crafted IOCTL lets a user-mode caller map arbitrary physical memory, breaking the kernel/user boundary and yielding high confidentiality, integrity, and availability impact across the security scope. Exploitation is strictly local (the assessed vector is AV:L/AC:L/PR:L/UI:N/S:C with all impacts High), no public exploit code has been identified at time of analysis, and the vendor was contacted but did not respond, so no vendor patch is confirmed.
Local privilege escalation in ColorFul iGameCenter 1.0.3.4 allows a low-privileged Windows user to reach kernel context by exploiting an untrusted pointer dereference in the bundled ENE driver ene.sys (IOCTL handler sub_140001AF0), which processes an attacker-supplied pointer without validation. The vulnerability is strictly local and requires the software plus its driver to already be installed and a local session to exist (CVSS 4.0 AV:L, PR:L, UI:N; assessed scope-changed impact of C:H/I:H/A:H), so remote mass exploitation is not possible; publicly available exploit code exists, but there is no confirmation of active exploitation (not in CISA KEV). ColorFul was contacted early and did not respond, so no vendor-released patch is identified at time of analysis, leaving driver removal or blocklisting as the practical mitigations.
Local privilege escalation in Colorful iGameCenter 2.0.0.81 stems from its bundled WinRing0x64.sys driver, whose sub_11504 IOCTL handler exposes arbitrary physical-memory access via attacker-controlled PhysicalAddress/AlignNumer/AlignSize arguments. A low-privileged local user can abuse this IOCTL Dispatch path to read and write kernel-visible physical memory and escalate to SYSTEM. Publicly available exploit code exists for the underlying WinRing0 driver class, but this specific CVE is not listed in CISA KEV and EPSS is unavailable; no active exploitation is confirmed.
Local privilege escalation in Colorful iGameCenter 2.0.0.82 allows an attacker who already holds a low-privileged session on the host to gain full control of the machine by abusing the AMDRyzenMasterDriver.sys kernel driver. The driver's Dispatch Handler passes an attacker-supplied SystemBuffer straight into MmMapIoSpace, so a crafted IOCTL lets a user-mode caller map arbitrary physical memory, breaking the kernel/user boundary and yielding high confidentiality, integrity, and availability impact across the security scope. Exploitation is strictly local (the assessed vector is AV:L/AC:L/PR:L/UI:N/S:C with all impacts High), no public exploit code has been identified at time of analysis, and the vendor was contacted but did not respond, so no vendor patch is confirmed.
Local privilege escalation in ColorFul iGameCenter 1.0.3.4 allows a low-privileged Windows user to reach kernel context by exploiting an untrusted pointer dereference in the bundled ENE driver ene.sys (IOCTL handler sub_140001AF0), which processes an attacker-supplied pointer without validation. The vulnerability is strictly local and requires the software plus its driver to already be installed and a local session to exist (CVSS 4.0 AV:L, PR:L, UI:N; assessed scope-changed impact of C:H/I:H/A:H), so remote mass exploitation is not possible; publicly available exploit code exists, but there is no confirmation of active exploitation (not in CISA KEV). ColorFul was contacted early and did not respond, so no vendor-released patch is identified at time of analysis, leaving driver removal or blocklisting as the practical mitigations.
Local privilege escalation in Colorful iGameCenter 2.0.0.81 stems from its bundled WinRing0x64.sys driver, whose sub_11504 IOCTL handler exposes arbitrary physical-memory access via attacker-controlled PhysicalAddress/AlignNumer/AlignSize arguments. A low-privileged local user can abuse this IOCTL Dispatch path to read and write kernel-visible physical memory and escalate to SYSTEM. Publicly available exploit code exists for the underlying WinRing0 driver class, but this specific CVE is not listed in CISA KEV and EPSS is unavailable; no active exploitation is confirmed.