CVE-2026-57851 is a local privilege escalation vulnerability in Micro-Star International's KernCoreLib64.sys kernel driver. The issue arises from exposed IOCTL handlers that do not enforce proper access control, enabling any local user to access the device object and perform arbitrary physical memory read/write and unrestricted I/O port operations. This can be leveraged to manipulate kernel objects, interfere with kernel-mode callbacks, bypass Protected Process Light protections, and disable security software, potentially compromising system integrity and security. The vulnerability is rated high severity with a CVSS 4.0 score of 8.5. There is no vendor advisory or patch information currently available, and no known exploits have been reported.

An attacker with local access can escalate privileges by exploiting the exposed IOCTL handlers to perform arbitrary physical memory and I/O port operations. This can lead to kernel object manipulation, bypassing of security protections such as Protected Process Light, and disabling of security software, significantly undermining system security and stability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local user access and monitor for suspicious activity related to the MSI KernCoreLib64.sys driver. Avoid running untrusted code locally and apply standard privilege management practices.