VulnerabilityPublished 12 Sep 2026

msi lpe poc

Source Reddit ExploitDev

Severity

Medium

Rated by Threat Radar

Data as of 12 Sep 2026, 22:17 UTC

What to do

AI-suggested

A fix has been verified by MSI following responsible disclosure on 2026-06-21. Users should apply the official MSI Dragon Center update that addresses this vulnerability. Until patched, restricting local user access to affected systems and uninstalling MSI Dragon Center may mitigate risk. No other mitigations are documented.

Discussion

An unauthenticated local privilege escalation vulnerability exists in the MODAPI.sys kernel driver installed by MSI Dragon Center 2.0.155.0. The driver exposes a device object with a security descriptor allowing any local user to open it without administrative privileges or UAC. This enables arbitrary read and write access to Model-Specific Registers (MSRs), including the IA32_LSTAR MSR, which controls the CPU syscall entry point. By overwriting IA32_LSTAR, an attacker can execute arbitrary code at kernel privilege level (CPL0), bypassing SMEP via gadgets found in the kernel image. The exploit was tested successfully on Windows 10 x64 22H2 (build 19045.6456) from a standard user account. The vulnerability was reported to MSI on 2026-06-21 and a fix has been verified.

r/ExploitDev (opens in a new tab)u/nanaynunay0 points0 comments

hi all, this is my repo, support pls https://github.com/mein-0/LolModapi

Links cited in the discussion

https://github.com/mein-0/LolModapi

Impact

An attacker with local user access can gain kernel-level code execution by exploiting this vulnerability. This allows full system compromise, including privilege escalation to SYSTEM. The exploit bypasses SMEP protections and requires no user interaction beyond running the exploit as a normal user. Systems with MSI Dragon Center 2.0.155.0 installed and the vulnerable MODAPI.sys driver loaded are affected.

Summary

The MODAPI.sys driver installed by MSI Dragon Center 2.0.155.0 contains a local privilege escalation vulnerability due to an insecure device object security descriptor that permits any local user to open a handle without admin rights. This handle allows unrestricted read and write access to MSRs, including IA32_LSTAR, which defines the CPU's syscall entry address. An attacker can read IA32_LSTAR to locate ntoskrnl!KiSystemCall64, parse the kernel image to find gadgets to disable SMEP, and overwrite IA32_LSTAR to redirect syscalls to attacker-controlled shellcode running at kernel privilege. The exploit requires no race conditions or heap grooming and works reliably on Windows 10 x64 22H2. The vulnerability was responsibly disclosed to MSI and a patch has been confirmed.

References

Community reviews

Loading reviews…

What to do

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 12 Sep 2026, 22:17 UTC

Technical details

References

Community reviews

Related threats