ZDI-26-430: MSI Center NTIOLib_X64 Origin Validation Error Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of MSI Center. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the NTIOLibX64.sys driver. The issue results from insufficient validation of the origin of commands. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.
Other sources
This vulnerability allows local attackers to escalate privileges on affected installations of MSI Center. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-6102.
— ZDI
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MSI Center NTIOLib_X64.systo a version that resolves this vulnerability.Patch ZDI-26-430 - Compensating control
Mitigate local exploitation by restricting access to MSI Center to trusted users/hosts (e.g., limit who can execute code on the system) until the MSI Center NTIOLib_X64.sys issue is fixed.
Event History
Frequently Asked Questions
What is the severity of ZDI-26-430?
The severity of ZDI-26-430 is rated as high with a CVSS score of 7.8.
How do I fix ZDI-26-430?
To fix ZDI-26-430, update the MSI Center software to the latest version that addresses the vulnerability.
What types of attacks does ZDI-26-430 allow?
ZDI-26-430 allows local privilege escalation attacks on affected installations of MSI Center.
What component is affected by the ZDI-26-430 vulnerability?
The ZDI-26-430 vulnerability affects the NTIOLib_X64.sys driver.
What must an attacker do to exploit ZDI-26-430?
An attacker must first execute low-privileged code on the target system to exploit ZDI-26-430.