ZDI-CAN-28935: ZDI-26-430: MSI Center NTIOLib_X64 Origin Validation Error Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of MSI Center. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the NTIOLibX64.sys driver. The issue results from insufficient validation of the origin of commands. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.
Other sources
This vulnerability allows local attackers to escalate privileges on affected installations of MSI Center. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-6102.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-28935?
The severity of ZDI-CAN-28935 is high, with a CVSS score of 7.8.
How do I fix ZDI-CAN-28935?
To fix ZDI-CAN-28935, update the MSI Center to the latest version released by MSI.
What type of attack does ZDI-CAN-28935 enable?
ZDI-CAN-28935 enables local privilege escalation attacks on affected installations of MSI Center.
What component is affected by ZDI-CAN-28935?
The specific component affected by ZDI-CAN-28935 is the NTIOLib_X64.sys driver.
What prerequisites are needed for exploiting ZDI-CAN-28935?
An attacker must have the ability to execute low-privileged code on the target system to exploit ZDI-CAN-28935.