CVE-2026-94425: Moore Threads MTT S80 Privilege Escalation

CVE-2026-94425 Overview

CVE-2026-94425 is an improper privilege management vulnerability [CWE-266] in the Moore Threads MTT S80 Driver Package version 340.150. The flaw resides in the sub_140006F0C function within the mtdispkm64.sys kernel driver, specifically in its IOCTL (I/O Control) handler. A local authenticated attacker can send crafted IOCTL requests to escalate privileges on the affected host. The vendor was contacted early about this disclosure but did not respond. No official patch is currently available.

Critical Impact
A local low-privileged user can abuse the mtdispkm64.sys IOCTL handler to gain kernel-level privileges, resulting in full system compromise.

Affected Products

Moore Threads MTT S80 Driver Package 340.150
mtdispkm64.sys kernel driver component
Windows systems with the vulnerable Moore Threads GPU driver installed

Discovery Timeline

2026-09-21 - CVE-2026-94425 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-94425

Vulnerability Analysis

The vulnerability affects the sub_140006F0C function inside mtdispkm64.sys, a signed kernel-mode driver shipped with the Moore Threads MTT S80 GPU driver package. This function is reachable through the driver's IOCTL dispatch table and does not enforce sufficient privilege checks on the calling process. As a result, any local user with the ability to open a handle to the driver's device object can invoke privileged operations. The weakness is classified under [CWE-266: Incorrect Privilege Assignment].

Exploitation runs entirely in the local security context and does not require user interaction beyond executing an unprivileged program. Because the vulnerable code executes at ring 0, successful abuse yields kernel-mode primitives such as arbitrary memory read/write or token manipulation.

Root Cause

The root cause is improper privilege management inside the driver's IOCTL handler. The affected function exposes sensitive operations without validating that the caller holds the required privileges or that the requested operation is safe for user-mode invocation. This design flaw allows standard users to trigger kernel operations that should be restricted to SYSTEM or administrative contexts.

Attack Vector

Exploitation requires local access and low privileges. An attacker executes code as a standard user, opens a handle to the mtdispkm64 device, and issues the crafted IOCTL code that reaches sub_140006F0C. The handler processes the request without appropriate access checks, enabling privilege escalation to NT AUTHORITY\SYSTEM. No verified public proof-of-concept has been published, and no in-the-wild exploitation has been reported. See the VulDB entry for CVE-2026-94425 for additional technical context.

Detection Methods for CVE-2026-94425

Indicators of Compromise

Presence of the vulnerable mtdispkm64.sys file at version corresponding to MTT S80 Driver Package 340.150
Unexpected processes opening handles to the Moore Threads GPU driver device object from non-graphics workloads
New SYSTEM-level processes spawned from user-context parents shortly after issuing device IOCTLs

Detection Strategies

Monitor DeviceIoControl calls targeting the Moore Threads driver device from non-privileged processes
Audit kernel driver load events (Windows Event ID 6) for mtdispkm64.sys to inventory exposed hosts
Correlate token privilege changes and process integrity level elevations with prior handle opens on the vulnerable driver

Monitoring Recommendations

Enable Sysmon Event ID 1 and 10 to capture process creation and process access patterns involving the driver
Track use of vulnerable-driver enumeration tools and Bring Your Own Vulnerable Driver (BYOVD) tradecraft on endpoints
Alert on standard user accounts that suddenly execute processes under SYSTEM context on hosts running MTT S80 drivers

How to Mitigate CVE-2026-94425

Immediate Actions Required

Inventory all systems with the Moore Threads MTT S80 Driver Package 340.150 installed
Restrict installation of the vulnerable driver on systems that do not require Moore Threads GPU functionality
Add mtdispkm64.sys to the Microsoft vulnerable driver blocklist policy on endpoints where the GPU is not needed
Limit local logon rights to trusted users to reduce the attack surface for local privilege escalation

Patch Information

No vendor patch is available. Moore Threads did not respond to the coordinated disclosure attempt referenced in the VulDB advisory. Monitor Moore Threads channels for a future driver update that supersedes version 340.150.

Workarounds

Uninstall the Moore Threads MTT S80 driver on systems that do not require the GPU
Enable Microsoft's Vulnerable Driver Blocklist through Windows Defender Application Control (WDAC) or Memory Integrity
Enforce least-privilege policies and application allowlisting to prevent execution of untrusted local exploit binaries
Isolate systems requiring the driver from general-purpose user workloads

bash

# Enable the Microsoft Vulnerable Driver Blocklist on Windows
# (Settings > Windows Security > Device Security > Core Isolation > Microsoft Vulnerable Driver Blocklist)
reg add "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config" /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 1 /f

# Verify installed Moore Threads driver version
pnputil /enum-drivers | findstr /i "mtdispkm64"