CVE-2026-94424: Moore Threads MTT S80 Buffer Overflow Flaw

CVE-2026-94424 Overview

CVE-2026-94424 is a heap-based buffer overflow [CWE-119] in the Moore Threads MTT S80 Driver Package up to version 340.150. The flaw resides in the sub_140001000 function within the mtdispkm64.sys kernel driver, specifically in its IOCTL handler component. A local attacker with low privileges can trigger the overflow by sending crafted input to the vulnerable IOCTL. Successful exploitation corrupts kernel heap memory and can lead to kernel-mode code execution or privilege escalation. The vendor was contacted about the disclosure but did not respond.

Critical Impact
Local attackers can corrupt kernel heap memory through a vulnerable IOCTL handler in mtdispkm64.sys, enabling privilege escalation to SYSTEM on affected Windows hosts running the Moore Threads MTT S80 GPU driver.

Affected Products

Moore Threads MTT S80 Driver Package versions up to and including 340.150
Vulnerable component: mtdispkm64.sys kernel driver
Affected function: sub_140001000 (IOCTL Handler)

Discovery Timeline

2026-09-21 - CVE-2026-94424 published to the National Vulnerability Database
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-94424

Vulnerability Analysis

The vulnerability exists in the sub_140001000 function of mtdispkm64.sys, a kernel-mode driver shipped with the Moore Threads MTT S80 GPU driver package. The function processes IOCTL requests from user mode without adequate bounds validation on the supplied buffer. When a request contains attacker-controlled data exceeding expected size limits, the driver writes past the allocated heap region in kernel memory.

Heap corruption in a kernel driver directly threatens the integrity of the operating system. An attacker who controls the overflow contents can overwrite adjacent pool structures, function pointers, or object headers. This provides a path from a low-privilege local account to arbitrary kernel-mode code execution.

The exploit prerequisites are limited to local access with any authenticated user context. No user interaction is required beyond issuing a DeviceIoControl call against the driver's device object.

Root Cause

The root cause is missing or improper validation of the input buffer length passed to the IOCTL handler in sub_140001000. The handler trusts caller-supplied size parameters and copies data into a fixed-size heap allocation, producing an out-of-bounds write classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer).

Attack Vector

Exploitation requires local code execution as an authenticated user. The attacker opens a handle to the driver's exposed device object and issues a crafted DeviceIoControl request targeting the vulnerable IOCTL code. The input buffer is sized to overflow the driver's heap allocation and overwrite adjacent kernel pool memory. Public technical details are limited; refer to the VulDB CVE-2026-94424 entry and VulDB Vulnerability #408150 for the current disclosure record.

No public proof-of-concept exploit code has been verified for this CVE. See the VulDB CTI Threat #408150 record for threat intelligence updates.

Detection Methods for CVE-2026-94424

Indicators of Compromise

Unexpected loading of mtdispkm64.sys on hosts without Moore Threads MTT S80 GPU hardware.
Kernel bugchecks referencing mtdispkm64.sys in the fault stack, particularly BAD_POOL_HEADER (0x19), KERNEL_MODE_HEAP_CORRUPTION (0x13A), or SYSTEM_SERVICE_EXCEPTION.
User-mode processes with no legitimate GPU workload opening handles to the Moore Threads driver device object.

Detection Strategies

Monitor for DeviceIoControl calls issued by non-graphics or unsigned processes against the mtdispkm64.sys device object.
Correlate driver-related kernel crashes with preceding process execution telemetry to identify local exploitation attempts.
Flag privilege escalation events where a low-integrity process spawns SYSTEM-context children shortly after interacting with the MTT S80 driver.

Monitoring Recommendations

Enable Windows kernel dump collection and forward WER and LiveKD artifacts to a centralized logging pipeline for review.
Ingest Sysmon Event IDs 1 (process create), 6 (driver load), and 10 (process access) into your SIEM and alert on anomalous access to GPU driver device objects.
Track driver version inventory across the fleet to identify hosts still running mtdispkm64.sys at or below version 340.150.

How to Mitigate CVE-2026-94424

Immediate Actions Required

Inventory all Windows endpoints and workstations running the Moore Threads MTT S80 Driver Package and record installed versions.
Restrict local logon and interactive session privileges on hosts with the vulnerable driver installed, especially shared workstations.
Where the MTT S80 GPU is not required, uninstall the driver package to eliminate the attack surface.

Patch Information

As of the last NVD update on 2026-09-22, no vendor patch has been published. According to the disclosure, the vendor did not respond to outreach. Monitor the VulDB CVE-2026-94424 record and Moore Threads driver release channels for a fixed version above 340.150.

Workarounds

Uninstall the Moore Threads MTT S80 driver package on systems that do not require the GPU.
Apply an application allowlist that prevents untrusted binaries from issuing IOCTL requests to the driver device object.
Enforce least-privilege for interactive users and disable local logon for service accounts to reduce the pool of principals capable of triggering the flaw.
Enable Hypervisor-Protected Code Integrity (HVCI) and Kernel DMA Protection where compatible to raise the cost of kernel exploitation.

bash

# Enumerate installed driver version on Windows (PowerShell)
Get-WmiObject Win32_PnPSignedDriver | 
  Where-Object { $_.DeviceName -like "*Moore Threads*" -or $_.DriverName -like "*mtdispkm64*" } |
  Select-Object DeviceName, DriverVersion, InfName

# Check whether the vulnerable driver is loaded
driverquery /v /fo csv | findstr /I "mtdispkm64"