CVE-2026-109520 Overview
CVE-2026-109520 is a local privilege escalation vulnerability in Colorful iGameCenter 2.0.0.82. The flaw exists in the MmMapIoSpace function within the AMDRyzenMasterDriver.sys kernel driver bundled with the application. An attacker with local, low-privileged access can manipulate the SystemBuffer argument passed to the driver's Dispatch Handler to perform unsafe privileged actions. The weakness is tracked as [CWE-266: Incorrect Privilege Assignment]. The vendor was contacted prior to public disclosure but did not respond. No vendor patch is currently available at the time of publication.
Critical Impact
A local attacker can abuse the vulnerable driver IOCTL to map arbitrary physical memory into user space, enabling kernel-level read/write primitives and escalation to SYSTEM privileges.
Affected Products
- Colorful iGameCenter 2.0.0.82
- AMDRyzenMasterDriver.sys component as distributed with iGameCenter
- Dispatch Handler accepting SystemBuffer input
Discovery Timeline
- 2026-10-13 - CVE-2026-109520 published to NVD
- 2026-10-15 - Last updated in NVD database
Technical Details for CVE-2026-109520
Vulnerability Analysis
The vulnerability resides in a Dispatch Handler inside AMDRyzenMasterDriver.sys, a signed kernel driver shipped with Colorful iGameCenter 2.0.0.82. The driver exposes an IOCTL interface that invokes MmMapIoSpace, a Windows kernel routine used to map a given physical address range into system virtual address space. The handler consumes attacker-controlled data from SystemBuffer without sufficient validation of the requested physical address or length.
Because the IOCTL is reachable from a low-privileged local process, an attacker can request mappings of arbitrary physical memory and then read or write that memory through the returned mapping. This produces an arbitrary kernel read/write primitive that bypasses the user/kernel boundary.
Root Cause
The root cause is incorrect privilege assignment [CWE-266] in the driver's I/O control dispatch. The driver trusts user-supplied parameters that drive a privileged kernel API. Access control on the device object is insufficient, and the parameters passed to MmMapIoSpace are not constrained to safe, driver-owned regions.
Attack Vector
Exploitation requires local access with low privileges. The attacker opens a handle to the driver's device object and issues a crafted DeviceIoControl call. The SystemBuffer contains physical address and size fields that the driver forwards to MmMapIoSpace. The returned virtual address allows the attacker to read or modify arbitrary physical memory, including kernel structures used to elevate the calling process token to SYSTEM. No user interaction is required and the attack complexity is low. See the VulDB entry for CVE-2026-109520 for additional context.
Detection Methods for CVE-2026-109520
Indicators of Compromise
- Loading of AMDRyzenMasterDriver.sys by processes other than legitimate Colorful iGameCenter components.
- Unexpected CreateFile handles opened against the AMD Ryzen Master driver device object by non-administrative processes.
- Processes performing token manipulation shortly after issuing DeviceIoControl to the vulnerable driver.
Detection Strategies
- Hunt for installations of AMDRyzenMasterDriver.sys on systems where Colorful iGameCenter is not a sanctioned application.
- Alert on known-vulnerable driver hashes using Microsoft's vulnerable driver blocklist and endpoint policy enforcement.
- Correlate kernel driver load events with subsequent process privilege changes to surface Bring-Your-Own-Vulnerable-Driver (BYOVD) behavior.
Monitoring Recommendations
- Enable kernel driver load telemetry (Sysmon Event ID 6) and ship it to a centralized analytics platform.
- Monitor IRP_MJ_DEVICE_CONTROL activity against third-party drivers that expose MmMapIoSpace-style primitives.
- Review Windows Defender Application Control (WDAC) and Hypervisor-protected Code Integrity (HVCI) logs for blocked driver load attempts.
How to Mitigate CVE-2026-109520
Immediate Actions Required
- Uninstall Colorful iGameCenter 2.0.0.82 on systems where it is not operationally required.
- Remove or quarantine the AMDRyzenMasterDriver.sys file shipped with the affected version.
- Enable the Microsoft Vulnerable Driver Blocklist to prevent known-bad driver loads at the kernel boundary.
- Restrict local logon rights to reduce the pool of users who can trigger the vulnerable IOCTL.
Patch Information
No vendor patch is available. According to the disclosure summary, the vendor was contacted early about this issue but did not respond. Monitor the VulDB vulnerability record #417176 and Colorful's official channels for future updates.
Workarounds
- Enable Hypervisor-protected Code Integrity (HVCI) and Windows Defender Application Control (WDAC) with a policy that blocks the vulnerable driver.
- Apply a WDAC deny rule targeting the specific hash and signer of the affected AMDRyzenMasterDriver.sys build.
- Enforce least-privilege account policies so that non-administrators cannot interact with third-party kernel drivers.
# Example: block the vulnerable driver via Microsoft's recommended blocklist
# Enable the Microsoft vulnerable driver blocklist in Windows Security:
# Settings > Privacy & security > Windows Security > Device security
# > Core isolation > Microsoft Vulnerable Driver Blocklist = On
# Verify driver presence on a host
Get-ChildItem -Path C:\Windows\System32\drivers\AMDRyzenMasterDriver.sys -ErrorAction SilentlyContinue |
Select-Object FullName, Length, LastWriteTime
# Stop and remove the service if installed
sc.exe stop AMDRyzenMasterDriver
sc.exe delete AMDRyzenMasterDriver
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
