CVE-2026-6102

Executive Summary

CVE-2026-6102 is a local privilege escalation vulnerability in MSI Center's NTIOLib_X64.sys kernel driver, caused by an origin validation error that permits unprivileged users to send arbitrary commands to the driver. An attacker with low-privileged code execution on a target system can exploit this flaw to execute arbitrary code in the context of SYSTEM, achieving complete compromise of the affected host. As of this report, no vendor patch exists, and the vulnerability remains unpatched with a CVSS score of 7.8 (High severity).

Technical Analysis

The vulnerability resides in the NTIOLib_X64.sys kernel driver, a component of MSI Center (the vendor's system management and monitoring suite). The driver exposes a DeviceIoControl-based interface to user-mode applications, allowing them to perform hardware-level operations such as reading/writing MSRs (model-specific registers), accessing PCI configuration space, and manipulating physical memory.

The flaw is classified as CWE-346 (Origin Validation Error). The driver fails to adequately validate the origin of incoming commands. Specifically, it does not properly verify that the caller is a legitimate, signed MSI Center process. Instead, it implicitly trusts any process that can open a handle to the device object. Under the Windows driver model, the device object (\Device\NTIOLib) is created with a default security descriptor that allows any user-mode process to obtain a handle via CreateFile, provided the device has not been explicitly restricted.

From a code-level perspective, the vulnerable IOCTL handler in NTIOLib_X64.sys processes requests without checking:

1. The PID of the calling process against a whitelist of signed MSI executables.
2. The integrity level of the calling process (should require Medium or High, but does not).
3. Whether the input buffer originates from a validated, signed component rather than an arbitrary user-mode buffer.

Because the driver runs in kernel mode (Ring 0), any IOCTL it processes executes with SYSTEM privileges. When an attacker sends a crafted IOCTL request that instructs the driver to write to an arbitrary kernel memory location (e.g., to modify a token's privileges or disable kernel protections), the driver complies blindly. This is a classic "unvalidated IOCTL" archetype, analogous to the historical vulnerabilities found in other hardware vendor drivers (e.g., GIGABYTE, ASUS, and older MSI drivers).

The attack surface is the local machine only — the driver is not reachable over the network. However, any low-privileged local user (even in a restricted AppContainer or guest account) can exploit this. Exploitation does not require user interaction beyond the initial foothold. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms this: local attack vector, low attack complexity, low privileges required, no user interaction, and full impact on confidentiality, integrity, and availability.

Exploitation Scenarios

Scenario: Privilege Escalation from Low-Privileged Code Execution

The following describes a concrete attack chain for CVE-2026-6102. While no public PoC is confirmed, the technique is derived from the vulnerability class and public research on similar NTIOLib driver flaws (e.g., CVE-2019-18845, CVE-2021-41285 in comparable drivers).

Step 1: Reconnaissance and Target Identification The attacker has already achieved low-privileged code execution on a target system (e.g., via phishing, malware, or a compromised service account). They enumerate the system to confirm the attack surface:

sc query NTIOLib_Mutex

They check if the device object exists and is accessible:

C:\> dir \\?\GLOBALROOT\Device\NTIOLib

They use tools like WinObj or a simple PowerShell script to confirm the device is present and has a permissive security descriptor.

Step 2: Device Handle Acquisition The attacker writes a small C/C++ program (or uses PowerShell with P/Invoke) to open a handle to the device:

HANDLE hDevice = CreateFileW(L"\\\\.\\NTIOLib", GENERIC_READ | GENERIC_WRITE,
                             FILE_SHARE_READ | FILE_SHARE_WRITE,
                             NULL, OPEN_EXISTING, 0, NULL);

Because the device object lacks an explicit security descriptor restricting access, this call succeeds even from a low-integrity process.

Step 3: Triggering the Vulnerability — IOCTL Weaponization The attacker identifies the vulnerable IOCTL code. Based on public research into NTIOLib drivers, the control codes are typically in the range 0x9C40xxxx. For this specific CVE (ZDI-CAN-28935), the vulnerable IOCTL is one that performs arbitrary physical memory read/write or MSR write. Common patterns include:

• IOCTL_NTIOLIB_READ_MSR — writes a specified MSR index and reads the value.
• IOCTL_NTIOLIB_WRITE_MSR — writes a specified value to an MSR.
• IOCTL_NTIOLIB_READ_PHYSICAL_MEM / IOCTL_NTIOLIB_WRITE_PHYSICAL_MEM — arbitrary physical memory access.

The attacker crafts an input buffer:

typedef struct _NTIOLIB_WRITE_MSR {
    DWORD Register;    // MSR index to write
    DWORD64 Value;     // Value to write
} NTIOLIB_WRITE_MSR;

NTIOLIB_WRITE_MSR inBuf = { 0xC0000082, 0 }; // LSTAR MSR, target value
DeviceIoControl(hDevice, IOCTL_NTIOLIB_WRITE_MSR, &inBuf, sizeof(inBuf),
                &outBuf, sizeof(outBuf), &bytesReturned, NULL);

The driver processes the request without validating the caller.

Step 4: Payload Execution The attacker uses the arbitrary write primitive to overwrite the system call table entry or a kernel function pointer. A common approach is to modify the nt!KiSystemServiceStart function pointer to redirect a syscall to attacker-controlled shellcode. Alternatively, the attacker targets the Token structure of a SYSTEM process (e.g., Winlogon.exe) to copy its Token into the current process, thereby gaining SYSTEM privileges:

// Query the EPROCESS of a SYSTEM process, read its Token, then write it over the current process token.

Step 5: Post-Exploitation With SYSTEM privileges, the attacker:

• Disables security products (AV/EDR) by terminating their processes or overwriting their drivers.
• Creates a new local administrator account: net user attacker P@ssw0rd! /add then net localgroup administrators attacker /add.
• Dumps LSASS memory to harvest domain credentials (procdump.exe -ma lsass.exe lsass.dmp).
• Pivots laterally to other systems using harvested credentials.
• Installs a kernel-mode rootkit for persistence (e.g., loading a malicious driver via the same vulnerable NTIOLib interface).

Note: This vulnerability requires local access. In cloud or virtualized environments without local user accounts, the attack surface is reduced.

Impact Assessment

The business impact of CVE-2026-6102 is severe for any organization where MSI Center is installed on employee workstations or servers leveraging MSI hardware.

CVSS Subscore Analysis:

• Confidentiality Impact (High): An attacker gains SYSTEM privileges, enabling access to all data on the host, including encrypted files (by puppeting the user's context), credentials, and sensitive business data.
• Integrity Impact (High): The attacker can modify system files, install rootkits, alter security policies, and backdoor the kernel. This compromises the integrity of the entire OS.
• Availability Impact (High): SYSTEM-level access allows the attacker to crash the system, disable services, or hold data for ransom (e.g., via ransomware that requires admin privileges).

Affected Systems:

• Any Windows system running MSI Center (all versions prior to a future patch). This includes MSI gaming laptops, desktop towers, and workstations using MSI motherboards.
• Virtualized environments where the driver is loaded into a Windows VM.
• Enterprise environments with Bring-Your-Own-Device (BYOD) policies that permit MSI hardware.

Blast Radius: The vulnerability is a single-system privilege escalation. However, in an enterprise, a single compromised workstation can serve as the launching point for lateral movement to domain controllers, file servers, and other high-value targets. Given the lack of a patch, the window of exposure is indefinite.

EPSS Consideration: The EPSS score of 0.00086 (0.4th percentile) indicates a low predicted likelihood of exploitation in the next 30 days. This is likely because the CVE was recently published and exploits are not yet weaponized. However, given the trivial nature of the vulnerability class, this score is expected to rise as public PoCs become available.

CISA KEV Status: Not listed on CISA's Known Exploited Vulnerabilities catalog, confirming no known in-the-wild exploitation as of writing.

Detection Guidance

Sigma Rule

title: MSI Center NTIOLib_x64.sys Privilege Escalation Attempt
id: 4a8e8c32-1f1a-4c3a-9a0f-5d8c3a6d2e9f
status: experimental
description: Detects attempts to exploit CVE-2026-6102 via DeviceIoControl on the NTIOLib device object from a non-standard process.
author: ValtersIT Threat Intel Team
date: 2026/02/15
logsource:
    category: process_creation
    product: windows
detection:
    selection_process:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\rundll32.exe'
            - '\msiexec.exe'
    selection_driverload:
        DriverName|contains: 'NTIOLib'
        DriverName|startswith: '\\Device\\'
    condition: selection_process and selection_driverload
falsepositives:
    - Legitimate MSI Center operations (limited to msi_center.exe)
level: high

YARA Rule

rule MSI_Center_NTIOLib_Exploit_CVE_2026_6102 {
    meta:
        author = "ValtersIT Threat Intel"
        description = "Detects exploit code attempting to interact with the MSI Center NTIOLib_x64.sys vulnerable device"
        date = "2026-02-15"
        reference = "CVE-2026-6102"
        severity = "high"
    strings:
        $s1 = "NTIOLib" ascii wide
        $s2 = "DeviceIoControl" ascii wide
        $s3 = "0x9C40" ascii wide nocase  // typical IOCTL base
        $s4 = "CreateFile" ascii wide
        $s5 = "\\\\.\\NTIOLib" ascii wide
        $s6 = "MSR" ascii wide nocase
        $s7 = "PHYSICAL_MEM" ascii wide nocase
        $c1 = { 48 89 5C 24 ?? 57 48 83 EC 20 }  // prologue of many C++ exploit tools
    condition:
        uint16(0) == 0x5A4D and  // MZ header
        (1 of ($s*)) and
        (2 of ($s*)) and
        (1 of ($c*))
}

Suricata IDS Rule

alert ip any any -> any any (msg:"MSI Center NTIOLib_x64.sys Exploitation Attempt (CVE-2026-6102)";
    flow:established;
    content:"|5c 00 5c 00 2e 00 5c 00 4e 00 54 00 49 00 4f 00 4c 00 69 00 62 00|";
    nocase;
    sid:10026102;
    rev:1;
    metadata:attack_target Windows, created_at 2026_02_15, cve CVE_2026_6102;
    classtype:attempted-admin;)

Note: This rule detects traffic that carries the encoded string "\\.\NTIOLib" in the payload. Since exploitation is local, this rule is most useful in a network environment where process execution is mirrored via file system telemetry or in SMB traffic.

Elastic Detection

// Detect processes opening handles to the NTIOLib device
process where event.action == "start" and
  process.args : ("*NTIOLib*", "*\\\\.\\NTIOLib*") and
  not process.executable : ("C:\\Program Files\\MSI\\*", "C:\\Program Files (x86)\\MSI\\*")

// Detect suspicious DeviceIoControl calls associated with physical memory/MSR writes
sequence by host.name
  [process where process.name : ("cmd.exe", "powershell.exe", "rundll32.exe") and event.action == "start"]
  [file where file.name : "NTIOLib_X64.sys" and file.path : "\\Device\\*"]

Splunk SPL Query

index=windows earliest=-7d
| search (Image IN ("cmd.exe", "powershell.exe", "explorer.exe", "rundll32.exe")) 
| where ProcessCommandLine LIKE "*NTIOLib*" OR ProcessCommandLine LIKE "*\\\\.\\NTIOLib*"
| search NOT ProcessCommandLine IN ("*MSI Center*")
| table _time, Computer, User, Image, ProcessCommandLine, ParentImage
| stats count by Computer, Image, User

Wazuh OSSEC Rule

<group name="windows-local-privilege-escalation,">
  <rule id="100612" level="12">
    <decoded>windows-sysmon</decoded>
    <field name="image">(cmd|powershell|rundll)\.exe</field>
    <field name="command_line">\\\\.\\NTIOLib</field>
    <description>Possible exploitation of MSI Center NTIOLib_x64.sys vulnerability (CVE-2026-6102)</description>
    <group>privilege_escalation,</group>
    <mitre>
      <id>T1068</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: Confirmed UNPATCHED (Patch Confidence: 0/4). No vendor advisory or patched version has been released for CVE-2026-6102.

Immediate Mitigations (until a patch exists)

1. Restrict access to the driver device object: Use Access Control Lists (ACLs) to restrict who can open a handle to \\.\NTIOLib. This can be accomplished by modifying the device object's security descriptor using tools like sc.exe sdset, although this is not persistent across driver reloads:

   sc sdset NTIOLib_Mutex D:(A;;RPWPCR;;;BU)(A;;RPWPCR;;;SY)
   

   This grants access only to Built-in Users (BU) with minimal rights and SYSTEM.
2. Disable the NTIOLib service/driver if MSI Center hardware monitoring is not mission-critical:

   sc stop NTIOLib_Mutex
   sc config NTIOLib_Mutex start= disabled
   

   Also disable the NTIOLib_X64 driver via sc config NTIOLib_X64 start= disabled.
3. Uninstall MSI Center on systems where hardware monitoring is externally (e.g., via BIOS) or can be replaced. MSI Center functionality can often be replaced by third-party tools (e.g., HWiNFO) that do not load kernel drivers.
4. Implement application control / allowlisting (e.g., Windows Defender Application Control, AppLocker) to prevent execution of unknown binaries that attempt to load or interact with the driver.
5. Deploy EDR/XDR solutions with behavioral detection rules (e.g., Sigma rules above) to alert on suspicious IOCTL calls or unexpected device handle opens.

Patch / Upgrade Steps

• None available. Monitor the ZDI page (ZDI-CAN-28935) and MSI's security advisories for a patched version of MSI Center. When a patch is released, upgrade MSI Center to the latest version immediately. Until then, treat all MSI Center installations as vulnerable.

Long-Term Hardening

1. Disable insecure kernel drivers by using Microsoft's recommended driver block rules. Add NTIOLib_X64.sys to a blocklist via Windows Defender Application Control (WDAC) or a custom driver blocklist using fltMC and group policy.
2. Enforce Least Privilege: Ensure end users do not have local administrator rights. While this CVE requires PR:L, restricting standard users to lower-privilege accounts reduces the attack surface of related post-exploitation actions.
3. Implement Privileged Access Workstations (PAWs): For high-value targets, use dedicated machines with strict application control and no third-party hardware utilities.
4. Device Governance: Maintain an inventory of hardware vendor drivers installed across the fleet. Implement a policy to replace software requiring vulnerable kernel drivers with alternatives or virtualized solutions.
5. Harden Windows: Apply Microsoft's recommended security baselines (CIS Benchmarks), enable Credential Guard and Device Guard to mitigate token theft post-exploitation.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-6102
• ZDI Advisory (ZDI-CAN-28935): https://www.zerodayinitiative.com/advisories/ZDI-CAN-28935/ (Expected to publish when patched)
• MSI Security Advisory: https://www.msi.com/support/security (Check for future advisories)
• CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (Not listed as of 2026-02-15)
• CWE-346 Reference: https://cwe.mitre.org/data/definitions/346.html

Threat Actor Campaigns: No known campaigns exploiting CVE-2026-6102 have been observed in the wild. The EPSS score (0.00086) suggests exploitation is not yet widespread. However, similar vulnerabilities in the NTIOLib driver family have been exploited by commodity malware (e.g., RobbinHood ransomware in 2020) and are a known target for sophisticated threat actors seeking persistence. Analysts should monitor for additions to the CISA KEV list and postings on exploit development forums.