CVE-2026-94424

Executive Summary

CVE-2026-94424 is a heap-based buffer overflow (CWE-119) in the Moore Threads MTT S80 Driver Package up to version 340.150, residing in the IOCTL handler of the kernel-mode driver library mtdispkm64.sys (function sub_140001000). The flaw is exploitable by a local attacker with low privileges, requiring no user interaction, and — per the CVSS scope-change (S:C) — can compromise resources beyond the driver's original security authority. With CVSS 8.8, successful exploitation yields high confidentiality, integrity, and availability impact, typically resulting in kernel-level code execution or privilege escalation to SYSTEM.

Technical Analysis

The vulnerability class is a heap-based buffer overflow. It occurs within the IOCTL (Input/Output Control) handler of the kernel driver mtdispkm64.sys, specifically in the function identified as sub_140001000. IOCTL handlers are the bridge between user-mode applications and kernel-mode driver logic: a user-mode process issues a DeviceIoControl call with an attacker-controlled input buffer and length. A heap-based overflow arises when the handler copies or processes data into a kernel heap-allocated buffer without correctly validating the size of the caller-supplied input. When the supplied data exceeds the allocated destination buffer, adjacent kernel heap memory is overwritten.

The NVD description confirms the manipulation "leads to heap-based buffer overflow" and that "an attack has to be approached locally." No additional implementation detail regarding the specific IOCTL code value, input structure layout, or bounds-check logic is provided in the available advisory data; therefore only the vulnerability class and its fundamental mechanism can be stated with confidence. The absence of a patch means the vulnerable code path remains present in releases up to and including 340.150.

Because this is a kernel-mode driver, the overflow executes in the highest privilege ring (ring 0). Corruption of kernel heap metadata or adjacent kernel objects can be leveraged to achieve arbitrary write or controlled execution flow, which is the standard escalation path for local kernel pool overflows. The CVSS scope change (S:C) reflects that the impact escapes the driver's own authority and affects the broader operating system security context.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-94424; the attack chain below is inferred at the vulnerability-class level from the NVD description and must not be read as a verified exploit recipe.

1. Reconnaissance / Target Identification. The attacker must first obtain local access to a Windows host on which the Moore Threads MTT S80 Driver Package (version 340.150 or earlier) is installed, and on which mtdispkm64.sys is loaded. This is confirmed by the presence of the driver and its associated user-mode interface. Because the vector is local (AV:L) with low privileges (PR:L), an attacker already holding a standard user account, or code executing as a standard user, is sufficient. The attacker identifies the device object exposed by mtdispkm64.sys that routes IOCTL requests to the vulnerable handler.

2. Triggering the Flaw Class. The attacker crafts an IOCTL request (via DeviceIoControl) directed at the driver's device. The vulnerable handler sub_140001000 processes attacker-controlled input without adequate size validation. By supplying an input buffer larger than the destination heap allocation, the attacker causes a heap-based buffer overflow in kernel memory. Reconnaissance is expected to involve observing how the driver responds to varying input sizes and noting where oversized inputs lead to corruption.

3. Payload / Execution Method. At the vulnerability-class level, exploitation of a kernel heap overflow typically proceeds by arranging kernel pool memory (spraying) such that the object located adjacent to the overflowing buffer is a target of value to the attacker, then using the overwrite to corrupt that object — for example, to redirect a function pointer or corrupt pool metadata — and thereby gain control of code execution in ring 0. The specific pool layout grooming steps and which exact kernel object can be targeted are not documented in the available advisory and are not fabricated here. No public PoC exists to confirm a working arrangement.

4. Post-Exploitation Impact. Per the CVSS vector (C:H/I:H/A:H, S:C), successful exploitation grants high confidentiality, integrity, and availability impact outside the driver's authority — in practice this means kernel-level code execution, which on Windows implies the ability to escalate to SYSTEM, disable security controls, persist as a kernel implant, or cause a system crash (bugcheck) if the overflow is merely triggered without refinement.

Impact Assessment

Affected systems are Windows hosts with the Moore Threads MTT S80 Driver Package installed at version 340.150 or earlier. These are typically GPU-equipped workstations, desktops, or servers running Moore Threads MTT S80 graphics hardware. The blast radius is bounded by the requirement for local access, but the scope-change (S:C) and high CIA impact scores mean that once triggered, the compromise is not contained to the driver — it can affect the whole operating system. Business impact includes full host compromise from a low-privileged starting position, potential lateral movement once SYSTEM is achieved, and loss of integrity for any workload on the host. The CVSS subscores (AV:L, AC:L, PR:L, UI:N) indicate a low-complexity, no-interaction local attack that is accessible to any holder of an unprivileged account on an affected machine. Availability impact is high, in part because a mishandled kernel overflow frequently results in an immediate system crash (blue screen). Because the vulnerability is UNPATCHED (Patch Confidence 0/4) and the vendor did not respond, the exposed population remains at risk indefinitely until a mitigating control is applied or hardware/driver is removed. No EPSS score is available (not yet scored by FIRST.org) and the CVE is not in CISA KEV; there is no evidence of active exploitation in the wild provided with this disclosure.

Detection Guidance

Sigma Rule

title: Suspicious IOCTL Traffic to Moore Threads mtdispkm64.sys Driver
id: 4f9c1a72-8b6e-4d2a-9c11-7a3e5b0c8d41
status: experimental
description: Detects potential abuse of the IOCTL handler in mtdispkm64.sys (CVE-2026-94424) via anomalous DeviceIoControl calls, oversized buffers, or unexpected handle access to the driver device.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94424
author: valtersit.com
date: 2026/01/01
logsource:
  product: windows
  category: process_access
detection:
  selection_driver:
    TargetImage|endswith: '\mtdispkm64.sys'
  selection_access:
    GrantedAccess|contains:
      - '0x1000'
      - '0x1400'
  condition: selection_driver and selection_access
falsepositives:
  - Legitimate Moore Threads GPU management and diagnostic tools
level: medium
tags:
  - attack.privilege_escalation
  - attack.t1068
  - cve.2026.94424

title: Unsigned or Unexpected Load of mtdispkm64.sys Kernel Driver
id: 9d2b7e55-1c3f-4a8b-b6d0-2e5f8c1a7b93
status: experimental
description: Detects loading of the vulnerable Moore Threads kernel driver, useful for correlating exploitation attempts of CVE-2026-94424.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 6
    ImageLoaded|endswith: '\mtdispkm64.sys'
  condition: selection
falsepositives:
  - Normal GPU driver initialization on hosts with MTT S80 hardware
level: low
tags:
  - attack.privilege_escalation
  - attack.t1068

YARA Rule

rule CVE_2026_94424_MooreThreads_mtdispkm64
{
    meta:
        description = "Detects Moore Threads MTT S80 kernel driver mtdispkm64.sys associated with CVE-2026-94424 heap overflow in IOCTL handler"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94424"
        cve = "CVE-2026-94424"

    strings:
        $mz = { 4D 5A }
        $driver = "mtdispkm64" ascii wide nocase
        $mt = "Moore Threads" ascii wide nocase
        $ioctl = "IOCTL" ascii wide

    condition:
        $mz at 0 and
        filesize < 20MB and
        ($driver or $mt) and
        $ioctl
}

Suricata IDS Rule

Note: CVE-2026-94424 is a purely local (AV:L) kernel IOCTL vulnerability and does not traverse the network. The rule below targets network-reachable delivery of a driver package or tooling associated with this CVE and should be considered best-effort correlation only.

alert http any any -> any any (msg:"CVE-2026-94424 Possible Moore Threads MTT S80 Driver Package Download"; flow:to_client,established; http.uri; content:"mtdispkm64"; nocase; http.uri; content:".sys"; nocase; classtype:attempted-user; reference:cve,2026-94424; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-94424; sid:202694424; rev:1;)

alert tcp any any -> any any (msg:"CVE-2026-94424 Moore Threads GPU Driver Installer Transfer"; flow:to_client,established; file_data; content:"mtdispkm64.sys"; nocase; classtype:attempted-user; reference:cve,2026-94424; sid:202694425; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.executable : "*.exe" and
  process.args : "*mtdispkm64*"

driver where event.action == "load" and
  dll.name : "mtdispkm64.sys"

Splunk SPL Query

index=windows (source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=6)
| search ImageLoaded="*\\mtdispkm64.sys"
| stats count min(_time) as first_seen max(_time) as last_seen by host, ImageLoaded, Image
| sort - last_seen

index=windows source="XmlWinEventLog:Security" EventCode=4656 OR EventCode=4663
| search ObjectName="*mtdispkm64*"
| eval risk="potential CVE-2026-94424 driver handle access"
| table _time host Account_Name ObjectName Access_Mask risk

Wazuh OSSEC Rule

<group name="windows,sysmon,privilege_escalation,">
  <rule id="2026944" level="10">
    <if_sid>61609</if_sid>
    <field name="win.eventdata.imageLoaded">mtdispkm64.sys</field>
    <description>CVE-2026-94424: Vulnerable Moore Threads MTT S80 driver mtdispkm64.sys loaded - possible exploitation attempt.</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>cve_2026_94424,</group>
  </rule>

  <rule id="2026945" level="8">
    <if_sid>60109</if_sid>
    <field name="win.eventdata.objectName">mtdispkm64</field>
    <description>CVE-2026-94424: Handle access to Moore Threads mtdispkm64 driver device object detected.</description>
    <group>cve_2026_94424,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The vendor was contacted about this disclosure and did not respond; no fixed version, vendor advisory, or official workaround is available.

1. Immediate mitigations

   • Because the flaw is a local, low-privilege, kernel-mode IOCTL overflow, the primary interim control is to restrict local access on hosts with the MTT S80 driver installed: enforce least privilege, remove unnecessary local accounts, and prevent untrusted code execution by standard users.
   • If the affected GPU hardware/driver is not operationally required, remove or disable the driver package (including mtdispkm64.sys) to eliminate the attack surface.
   • Apply driver blocklisting via Windows Defender Application Control (WDAC) or a Microsoft vulnerable-driver block list policy so that the known-vulnerable driver cannot be loaded on managed endpoints, where operationally feasible.
   • Monitor for anomalous handle access to the driver device and for unexpected loads of mtdispkm64.sys; investigate any host that triggers the detection rules above, as a local overflow may precede a crash (bugcheck) or SYSTEM-level compromise.

2. Patch / upgrade steps

   • No patch exists. Monitor Moore Threads' official support/download channels for a driver update beyond version 340.150 that addresses the IOCTL handler. Do not assume any specific version will contain a fix — verify against a vendor advisory when one is published.
   • Until a vendor fix is confirmed, treat all versions up to and including 340.150 as vulnerable.

3. Long-term hardening

   • Maintain a hardware/driver inventory and track kernel-mode driver versions against known-vulnerable driver lists.
   • Enable kernel exploit protections available on modern Windows (e.g., HVCI, kernel pool hardening) to raise the difficulty of reliably weaponizing a kernel heap overflow.
   • Require vendor security-response commitments for critical GPU/kernel drivers; the absence of a vendor response here represents a supply-chain risk that should factor into procurement and risk decisions.
   • Establish compensating controls (application allowlisting, endpoint detection and response coverage for driver-load and handle-access telemetry) so that local privilege-escalation attempts in kernel drivers are detected even when individual CVEs are unpatched.

References

• NVD — CVE-2026-94424: https://nvd.nist.gov/vuln/detail/CVE-2026-94424
• CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer — https://cwe.mitre.org/data/definitions/119.html
• MITRE ATT&CK T1068 — Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/
• FIRST EPSS (score not yet available for this CVE): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-94424 in the data provided. No public PoC, exploit code, or Nuclei template exists at the time of writing.