CVE-2026-57851: MSI Feature Manager Privilege Escalation

CVE-2026-57851 Overview

CVE-2026-57851 is a local privilege escalation vulnerability in the MSI Feature Manager KernCoreLib64.sys kernel driver. The driver exposes a device object with input/output control (IOCTL) handlers that lack proper access checks. Any locally authenticated user can invoke these handlers to perform arbitrary physical memory read and write operations, as well as unrestricted I/O port access. Attackers use these primitives to manipulate kernel objects, tamper with kernel-mode callbacks, bypass Protected Process Light (PPL) protections, and disable endpoint security software. The vulnerability is categorized under [CWE-782] (Exposed IOCTL with Insufficient Access Control).

Critical Impact
A standard user can gain kernel-level code execution, disable security tooling, and achieve full SYSTEM compromise on affected Windows hosts.

Affected Products

MSI Feature Manager with the KernCoreLib64.sys kernel driver
MSI GameGaraj components bundled with the vulnerable driver
Windows systems where the signed vulnerable driver has been loaded

Discovery Timeline

2026-07-07 - CVE-2026-57851 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-57851

Vulnerability Analysis

The KernCoreLib64.sys driver creates a device object accessible to non-privileged users. Its IOCTL dispatch routines expose kernel primitives without validating the caller's security context. An authenticated local user can open a handle to the device and issue IOCTLs that translate directly into physical memory operations and raw port I/O. These primitives constitute an unrestricted read/write capability against kernel memory. Once inside the kernel, an attacker can rewrite token privileges, replace process protection levels, unhook PsSetCreateProcessNotifyRoutine callbacks, and neutralize antivirus or endpoint detection agents. The driver is signed, which enables Bring Your Own Vulnerable Driver (BYOVD) reuse across systems where MSI Feature Manager is not installed.

Root Cause

The root cause is improper access control on IOCTL handlers, as classified by [CWE-782]. The driver fails to restrict privileged operations to callers holding administrator or SYSTEM tokens. Physical memory and I/O port primitives are exposed through the standard device interface without an access control list (ACL) or caller validation.

Attack Vector

Exploitation requires local authenticated access and low privileges. An attacker opens the device object using CreateFileW against the driver symbolic link, then calls DeviceIoControl with crafted IOCTL codes to perform physical memory writes. Public proof-of-concept material is available in the GitHub CVE PoC Repository and the VulnCheck Security Advisory. No verified code examples are reproduced here; refer to the linked advisory for technical details.

Detection Methods for CVE-2026-57851

Indicators of Compromise

Presence of KernCoreLib64.sys loaded on hosts that do not require MSI Feature Manager or MSI GameGaraj
Creation of a service or driver load event referencing the KernCoreLib64 image path from non-standard directories
Unexpected handle opens to the driver's device object by non-MSI processes
Sudden termination or tampering of endpoint security service processes shortly after driver load

Detection Strategies

Monitor Windows Event Log ID 7045 and Sysmon Event ID 6 for driver loads matching KernCoreLib64.sys hash or filename
Alert on DeviceIoControl calls from unsigned or user-launched binaries targeting the MSI driver device object
Correlate driver load events with subsequent PPL-protected process modifications or callback removals
Apply Microsoft's vulnerable driver blocklist and enable Hypervisor-Protected Code Integrity (HVCI) enforcement

Monitoring Recommendations

Track kernel driver installations on endpoints and flag drivers appearing on the LOLDrivers or Microsoft vulnerable driver lists
Baseline expected drivers per host role and alert on deviations, particularly on servers and privileged workstations
Ingest driver load telemetry into the SIEM for retroactive hunting when new BYOVD techniques emerge

How to Mitigate CVE-2026-57851

Immediate Actions Required

Uninstall MSI Feature Manager and MSI GameGaraj from systems that do not require them
Remove or block the KernCoreLib64.sys driver file where the software is not needed
Enable the Microsoft recommended driver blocklist and confirm the vulnerable driver hash is included
Enforce HVCI and Memory Integrity to prevent unsigned or blocked drivers from loading

Patch Information

No vendor patch has been referenced in the available advisories at the time of publication. Consult the VulnCheck Security Advisory for updated remediation guidance and any subsequent MSI vendor response.

Workarounds

Deploy Windows Defender Application Control (WDAC) policies that deny the vulnerable driver by SHA-256 hash
Restrict local logon rights on sensitive hosts to reduce the pool of users able to invoke the driver
Use Attack Surface Reduction rules to block untrusted processes from opening handles to third-party kernel drivers

bash

# Configuration example: block the vulnerable driver via Microsoft driver blocklist
# Enable Microsoft vulnerable driver blocklist (Windows 11 / Server 2022+)
reg add "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config" /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 1 /f

# Verify HVCI / Memory Integrity is enforced
reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity"