An exposed IOCTL with insufficient access control in ASUS System Control Interface allows a local, low-privileged user to read and write arbitrary physical memory through crafted device control requests, ultimately resulting in a complete compromise of the affected system.
Refer to the ' Security Update for ASUS System Control Interface ' section on the ASUS Security Advisory for more information.
Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to add an arbitrary process identifier to the driver's whitelist via a crafted IOCTL request by bypassing the driver's verification.Refer to the '
Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.
Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to read and write arbitrary PCI/PCIe configuration space via crafted IOCTL requests by bypassing the driver's verification.
Refer to the '
Security Update for Armoury Crate App' section on the ASUS Security Advisory for more information.
Exposed IOCTL with insufficient access control in ASUS Armoury Crate allows a local user to disclosure information and disabling device functionality by bypassing driver authentication and using IOCTLs to read from and write to PCIe configuration space.Refer to the '
Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.
CVE-2026-9492 is an improper access control vulnerability in the MBStorage DRAM lighting control module of Gigabyte Control Center. Authenticated local attackers can send specific IOCTL commands via the MyPortIO_x64.sys driver, allowing arbitrary physical memory read/write and kernel-level privilege escalation. The vulnerability has a high severity score of 8.5. No patch or official remediation has been confirmed yet.
MSI Feature Manager contains a local privilege escalation vulnerability in the KernCoreLib64.sys kernel driver that allows any locally logged-on user to perform arbitrary physical memory read/write and unrestricted I/O port operations by accessing exposed IOCTL handlers without administrator privileges. Attackers can exploit the accessible device object through IOCTL handlers to manipulate kernel objects, tamper with kernel-mode callbacks, bypass Protected Process Light protections, and disable security software.
An access control deficiency vulnerability exists in ExpressUpdate Agent for Windows. If a malicious user gains access to the product, arbitrary code could be executed with SYSTEM privileges.
CVE-2025-15641 is a vulnerability in the Netskope Client for Windows where a malicious insider with administrative privileges can send crafted IOCTL requests to the driver. This can bypass all anti-tampering protections for the Netskope Client. The issue affects all versions below R138. The vulnerability has a medium severity with a CVSS score of 6.8.
CVE-2026-8501 is a high-severity vulnerability in the Symantec PC Tools Internet Security product. It involves improper access control in the PCTCore64.sys Windows kernel driver, allowing local user-mode processes to access privileged IOCTL handlers via the PCTCoreDriver WDM device interface. This can enable a local attacker with access to the driver to perform sensitive and privileged operations on the affected system. There is no confirmed patch or official remediation available at this time, and no known exploits have been reported in the wild.
An Exposed IOCTL with Insufficient Access Control vulnerability in AsusPTPFilter allows a local user to bypass driver security mechanisms and obtain restricted touchpad information or render the touchpad unusable via crafted IOCTL requests.Refer to the '
Security Update for ASUS Precision Touchpad ' section on the ASUS Security Advisory for more information.
CVE-2026-4483 is a high-severity vulnerability in Moxa's MxGeneralIo utility for industrial x86 computers. It involves an exposed IOCTL interface with insufficient access control, allowing local attackers with high privileges to perform unauthorized read/write operations on MSR and system memory. Exploitation can lead to privilege escalation on Windows 7 or cause system crashes (BSoD) on Windows 10 and 11, resulting in denial-of-service. The vulnerability primarily impacts system availability, with minor effects on confidentiality and integrity. No patch or official remediation has been confirmed yet.
A potential insufficient access control vulnerability was reported in the Lenovo Dispatcher 3.0 and Dispatcher 3.1 drivers used by some Lenovo consumer notebooks that could allow an authenticated local user to execute code with elevated privileges. The Lenovo Dispatcher 3.2 driver is not affected. This vulnerability does not affect systems when the Windows feature Core Isolation Memory Integrity is enabled. Lenovo systems preloaded with Windows 11 have this feature enabled by default.
ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmMapIoSpace function. This insecure implementation can be exploited by a malicious user-mode application to patch the running Windows kernel and invoke arbitrary kernel functions with ring-0 privileges. The vulnerability enables local attackers to execute arbitrary code in kernel context, resulting in privilege escalation and potential follow-on attacks, such as disabling security software or bypassing kernel-level protections. ThrottleStop.sys version 3.0.0.0 and possibly others are affected. Apply updates per vendor instructions.
An improper input validation vulnerability was discovered in Avaya IP Office that could allow remote command or code execution via a specially crafted web request to the Web Control component. Affected versions include all versions prior to 11.1.3.1.