Msi Center
Monthly
Local privilege escalation in MSI Center's bundled NTIOLib_X64.sys kernel driver lets a low-privileged user execute arbitrary code as SYSTEM by issuing commands the driver fails to properly authenticate. The flaw (ZDI-CAN-28935 / ZDI-26-430) stems from the driver not validating the origin of incoming commands, so any local process can drive its privileged I/O primitives. There is no public exploit identified at time of analysis and it is not on CISA KEV, but ZDI's disclosure and the NTIOLib family's history of abuse make weaponization plausible.
Local privilege escalation in MSI Center's bundled NTIOLib_X64.sys kernel driver lets a low-privileged user execute arbitrary code as SYSTEM by issuing commands the driver fails to properly authenticate. The flaw (ZDI-CAN-28935 / ZDI-26-430) stems from the driver not validating the origin of incoming commands, so any local process can drive its privileged I/O primitives. There is no public exploit identified at time of analysis and it is not on CISA KEV, but ZDI's disclosure and the NTIOLib family's history of abuse make weaponization plausible.