Mtt S80 Driver Package
Monthly
Local privilege escalation in the Moore Threads MTT S80 Driver Package 340.150 allows a low-privileged local user to abuse an improperly secured IOCTL handler and gain high-impact control over the system. The flaw resides in the Windows kernel-mode driver mtdispkm64.sys, specifically function sub_140006F0C, and is classified as CWE-269 improper privilege management; successful abuse yields high confidentiality, integrity and availability impact on both the vulnerable component and the subsequently compromised host. Exploitation requires an existing local foothold on a Windows machine with this specific GPU driver installed, with low privileges and no user interaction needed (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; vendor-published CVSS 4.0 score 9.3). No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, but the low attack complexity and the absence of a vendor patch make the flaw attractive to local attackers already present on a host.
A heap-based buffer overflow (CWE-122) in the IOCTL handler (sub_140001000) of mtdispkm64.sys, the kernel-mode display driver shipped with the Moore Threads MTT S80 GPU driver package up to version 340.150, lets a local low-privileged user who can open a handle to the driver's device object supply a malformed IOCTL request and corrupt kernel pool memory, potentially achieving elevation to SYSTEM. The flaw is not remotely reachable (AV:L, PR:L per the assessed CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, rated 9.3), and exploitation is confined to Windows hosts that actually have this niche GPU driver installed and loaded. There is no vendor patch because Moore Threads did not respond to the disclosure, and no public exploit code has been identified at time of analysis.
Local privilege escalation in the Moore Threads MTT S80 Driver Package 340.150 allows a low-privileged local user to abuse an improperly secured IOCTL handler and gain high-impact control over the system. The flaw resides in the Windows kernel-mode driver mtdispkm64.sys, specifically function sub_140006F0C, and is classified as CWE-269 improper privilege management; successful abuse yields high confidentiality, integrity and availability impact on both the vulnerable component and the subsequently compromised host. Exploitation requires an existing local foothold on a Windows machine with this specific GPU driver installed, with low privileges and no user interaction needed (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; vendor-published CVSS 4.0 score 9.3). No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, but the low attack complexity and the absence of a vendor patch make the flaw attractive to local attackers already present on a host.
A heap-based buffer overflow (CWE-122) in the IOCTL handler (sub_140001000) of mtdispkm64.sys, the kernel-mode display driver shipped with the Moore Threads MTT S80 GPU driver package up to version 340.150, lets a local low-privileged user who can open a handle to the driver's device object supply a malformed IOCTL request and corrupt kernel pool memory, potentially achieving elevation to SYSTEM. The flaw is not remotely reachable (AV:L, PR:L per the assessed CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, rated 9.3), and exploitation is confined to Windows hosts that actually have this niche GPU driver installed and loaded. There is no vendor patch because Moore Threads did not respond to the disclosure, and no public exploit code has been identified at time of analysis.