CVE-2026-19381: Kingston FURY CTRL Privilege Escalation

CVE-2026-19381 Overview

CVE-2026-19381 is a local privilege escalation vulnerability in Kingston FURY CTRL RGB Control Software version 2.0.65.0. The flaw resides in an unknown function within the NTIOLib_KSFX.sys driver component. Improper privilege management [CWE-266] allows a local attacker with low privileges to manipulate the driver and gain elevated access to affected Windows hosts. The exploit has been released publicly, increasing the risk of opportunistic abuse. According to public disclosure, the vendor was contacted early but did not respond.

Critical Impact
A local low-privileged attacker can abuse the NTIOLib_KSFX.sys kernel driver to escalate privileges and compromise the confidentiality, integrity, and availability of the host.

Affected Products

Kingston FURY CTRL RGB Control Software 2.0.65.0
Component: NTIOLib_KSFX.sys driver
Windows systems running the affected driver version

Discovery Timeline

2026-08-10 - CVE-2026-19381 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-19381

Vulnerability Analysis

The vulnerability affects the NTIOLib_KSFX.sys kernel-mode driver distributed with Kingston FURY CTRL RGB Control Software 2.0.65.0. Kernel drivers execute in Ring 0 and must strictly validate which callers are permitted to invoke privileged operations. In this case, the driver fails to enforce adequate access controls on one or more of its exposed interfaces.

A local user with standard privileges can open a handle to the driver and issue crafted requests that trigger privileged functionality. This is a classic vulnerable-driver pattern [CWE-266], where legitimate device drivers become abuse primitives for privilege escalation on otherwise patched systems.

Successful exploitation grants attackers the ability to read, modify, or disable system resources at the highest privilege level. Public exploit code exists, and no vendor response has been recorded at the time of disclosure.

Root Cause

The root cause is improper privilege management within NTIOLib_KSFX.sys. The driver exposes functionality reachable from user mode without validating whether the calling process holds the necessary privileges. This design pattern is common in OEM utility drivers that provide direct hardware access for RGB control, fan management, and diagnostics.

Attack Vector

Exploitation requires local access and low-privileged authentication. An attacker executes code as a standard user, opens the driver device object, and issues IOCTLs that the driver processes without proper authorization checks. The public availability of an exploit lowers the barrier for use in post-compromise scenarios such as ransomware staging or persistence.

Code examples are not reproduced here. See the VulDB entry for CVE-2026-19381 and the associated VulDB vulnerability record #387274 for technical references.

Detection Methods for CVE-2026-19381

Indicators of Compromise

Presence of NTIOLib_KSFX.sys on endpoints where Kingston FURY CTRL RGB Control Software is not required for business use.
Unexpected loading of NTIOLib_KSFX.sys by non-Kingston processes or from unusual paths.
New services or scheduled tasks that reference the driver outside of normal software installation events.

Detection Strategies

Inventory endpoints for the vulnerable driver hash and file version, and flag any instance of NTIOLib_KSFX.sys version 2.0.65.0.
Monitor kernel driver load events (Windows Event ID 6, Sysmon Event ID 6) for NTIOLib_KSFX.sys and correlate with the loading process.
Alert on non-administrator processes opening handles to the driver device object.

Monitoring Recommendations

Enable Microsoft's Vulnerable Driver Blocklist and verify that abusable OEM drivers are enumerated.
Track process token elevation events following interactions with third-party kernel drivers.
Collect and retain driver load telemetry centrally for retroactive hunting once new bring-your-own-vulnerable-driver (BYOVD) indicators emerge.

How to Mitigate CVE-2026-19381

Immediate Actions Required

Identify and remove Kingston FURY CTRL RGB Control Software 2.0.65.0 from systems that do not require RGB control functionality.
Add NTIOLib_KSFX.sys (version 2.0.65.0) to the Microsoft Vulnerable Driver Blocklist or equivalent driver blocklisting mechanism.
Restrict local administrative access and enforce least privilege to reduce the pool of users able to invoke the driver.

Patch Information

No vendor patch has been published at the time of writing. Public disclosure notes that Kingston was contacted early but did not respond. Monitor the VulDB record for CVE-2026-19381 and Kingston's support channels for updated firmware or software releases.

Workarounds

Uninstall Kingston FURY CTRL RGB Control Software until a fixed release is available.
Enable Windows Hypervisor-protected Code Integrity (HVCI) and the Microsoft Vulnerable Driver Blocklist to block known abusable drivers.
Apply application control policies (Windows Defender Application Control or AppLocker) to prevent unauthorized driver installation.
Restrict standard users from installing third-party software that ships kernel drivers.

bash

# Enable the Microsoft Vulnerable Driver Blocklist via registry (Windows 11 / Server 2022+)
reg add "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config" /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 1 /f

# Verify the driver is not present on the endpoint
Get-ChildItem -Path C:\ -Recurse -Filter NTIOLib_KSFX.sys -ErrorAction SilentlyContinue