CVE-2026-94403: ColorFul iGameCenter Use-After-Free Flaw

CVE-2026-94403 Overview

CVE-2026-94403 is an untrusted pointer dereference vulnerability in ColorFul iGameCenter version 1.0.3.4. The flaw resides in the sub_140001AF0 function within the ene.sys driver library, specifically in the IOCTL handler component. A local attacker with low privileges can send crafted IOCTL requests to the vulnerable driver, triggering dereference of an attacker-controlled pointer. Because ene.sys operates in kernel space, successful exploitation can lead to arbitrary kernel memory access, privilege escalation, or system compromise. The exploit has been published, and the vendor did not respond to disclosure attempts. This vulnerability is classified under [CWE-822: Untrusted Pointer Dereference].

Critical Impact
A local attacker can supply untrusted pointer values to a kernel driver IOCTL, enabling kernel memory corruption and full system compromise on affected hosts.

Affected Products

ColorFul iGameCenter 1.0.3.4
ene.sys kernel driver library (as bundled with iGameCenter)
Windows systems where iGameCenter installs the vulnerable driver

Discovery Timeline

2026-09-21 - CVE-2026-94403 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-94403

Vulnerability Analysis

The vulnerability lives in the IOCTL handler at sub_140001AF0 inside ene.sys, the kernel-mode driver shipped with ColorFul iGameCenter. The handler accepts input from user mode without validating pointer values passed through the IOCTL interface. When the driver dereferences these untrusted pointers, it operates on attacker-controlled kernel memory addresses.

Attackers with local access can open a handle to the driver's device object and issue DeviceIoControl calls containing crafted input structures. The driver then reads from or writes to arbitrary kernel addresses, depending on the code path reached. This class of driver flaw is commonly abused for local privilege escalation and for bypassing endpoint protections through Bring Your Own Vulnerable Driver (BYOVD) techniques.

Root Cause

The root cause is missing pointer validation inside the IOCTL dispatch routine. The driver trusts user-supplied buffer contents and treats embedded values as kernel-resident pointers without probing the addresses or verifying provenance. [CWE-822] describes this exact pattern, where the software dereferences a pointer whose value comes from an untrusted source.

Attack Vector

Exploitation requires local access and low privileges on a system where iGameCenter is installed. The attack does not require user interaction. An attacker opens the driver device, issues an IOCTL to reach sub_140001AF0, and supplies a malicious pointer in the input buffer. The driver dereferences the pointer in kernel context, providing a primitive that can escalate to SYSTEM. Public exploit availability lowers the barrier to weaponization.

No verified proof-of-concept code is included here. Refer to the VulDB entry for CVE-2026-94403 and the associated VulDB vulnerability record #408110 for technical details.

Detection Methods for CVE-2026-94403

Indicators of Compromise

Presence of ene.sys loaded on systems where ColorFul iGameCenter 1.0.3.4 is installed or where the driver has been dropped independently.
Unexpected user-mode processes opening handles to the iGameCenter driver device and issuing DeviceIoControl calls.
Kernel bug checks or SYSTEM_SERVICE_EXCEPTION / KMODE_EXCEPTION_NOT_HANDLED crashes referencing ene.sys.

Detection Strategies

Enumerate installed drivers and flag ene.sys instances, particularly on systems that should not run gaming utilities.
Monitor for driver-load events (Windows Event ID 6, Sysmon Event ID 6) referencing ene.sys signed by ColorFul.
Hunt for suspicious IOCTL activity from non-standard binaries against the iGameCenter device object.

Monitoring Recommendations

Ingest kernel driver load telemetry and correlate with process lineage to detect BYOVD staging.
Alert on newly created services or driver files matching the ene.sys hash on hosts without an approved iGameCenter installation.
Track privilege escalation events immediately following interaction with the vulnerable driver.

How to Mitigate CVE-2026-94403

Immediate Actions Required

Uninstall ColorFul iGameCenter 1.0.3.4 from endpoints that do not require it.
Remove or block loading of the ene.sys driver where iGameCenter functionality is not needed.
Add the vulnerable ene.sys file hash to the Microsoft Vulnerable Driver Blocklist and to endpoint driver control policies.

Patch Information

No vendor patch is available. The vendor was contacted about this disclosure but did not respond. Until a fixed driver is released, treat any system carrying the vulnerable ene.sys as exposed to local privilege escalation. Track the VulDB advisory for future updates.

Workarounds

Enable Microsoft's Vulnerable Driver Blocklist and Hypervisor-Protected Code Integrity (HVCI) to prevent the driver from loading.
Restrict local logon rights and enforce least privilege to reduce the pool of users who can invoke the driver.
Apply Windows Defender Application Control (WDAC) policies that deny execution of the affected ene.sys binary by hash.

bash

# Example WDAC/driver blocklist entry (conceptual)
# Deny load of ene.sys by SHA256 hash using a WDAC policy
<Deny ID="ID_DENY_ENE_SYS" FriendlyName="Block vulnerable ene.sys" Hash="<SHA256_OF_ENE_SYS>" />