Description

A vulnerability was found in MSI Dragon Center up to 2.0.155.0. Affected by this vulnerability is the function MmioWritePath in the library NTIOLib_X64.sys of the component MMIO Write Path Handler. Performing a manipulation of the argument count/elementSize results in integer overflow. The attack requires a local approach. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-31T21:17:54.503Z",
  "pubdate": "2026-08-31T21:17:54.503Z",
  "executiveSummary": "A critical security vulnerability exists in the NTIOLib_X64.sys driver utilized by MSI Dragon Center versions up to 2.0.155.0. The vulnerability is classified as an integer overflow occurring within the MMIO Write Path Handler component.\nThe flaw stems from improper handling of the argument count or elementSize parameters within the MmioWritePath function. By manipulating these input parameters, an attacker can trigger an integer overflow, which may lead to heap-based buffer overflows or unauthorized memory access.\nThis vulnerability is restricted to local exploitation, requiring the attacker to have already gained a foothold on the target system. Given that the vulnerable component is a kernel-mode driver, successful exploitation poses a significant risk of arbitrary code execution at the kernel level (Ring 0), potentially leading to complete system compromise or privilege escalation.\nThe vulnerability disclosure is public, and the lack of vendor response indicates that no official patches are currently available. Consequently, the risk of exploitation remains high for users running the affected software version.",
  "technicalDetails": "The vulnerability resides within the MmioWritePath function located in the kernel-mode driver NTIOLib_X64.sys, which serves as a component of the MSI Dragon Center software suite. The core issue is an integer overflow vulnerability triggered by the insecure processing of user-supplied input parameters, specifically 'argument count' and 'elementSize'.\nIn kernel-mode drivers, memory allocation and boundary checks are critical. The MmioWritePath function performs a calculation to determine the amount of memory to allocate or process based on these parameters. If the product of the 'argument count' and 'elementSize' exceeds the maximum value representable by the integer type (typically a 32-bit unsigned integer), the resulting value wraps around. This wraparound creates a discrepancy between the size requested for the operation and the actual memory allocated on the heap.\nExploitation flow typically begins with an attacker executing a local process that communicates with the NTIOLib_X64.sys driver via DeviceIoControl calls. By crafting a specific request that passes values designed to trigger the arithmetic overflow, the attacker can force the kernel to allocate a buffer that is significantly smaller than the data intended to be copied into it. When the subsequent write operation occurs, the driver performs an out-of-bounds write (buffer overflow) into kernel memory.\nThis overwrite capability allows the attacker to corrupt adjacent kernel memory structures, such as object headers or function pointers. By carefully grooming the kernel heap, an attacker may achieve arbitrary read/write primitives. This can be weaponized to overwrite control flow structures, enabling the execution of arbitrary shellcode within the kernel context. Since the driver operates with kernel-level privileges, this effectively grants the attacker total control over the operating system, bypassing standard user-mode security boundaries and potentially disabling endpoint protection mechanisms.\nThe vulnerability is present in all MSI Dragon Center versions up to 2.0.155.0. The lack of input validation on the length parameters during the transition from user-mode to kernel-mode space is the primary vector for this local attack. Given the public availability of exploits, there is a high probability of malicious actors utilizing this path to achieve post-exploitation objectives, including persistence, credential harvesting, and lateral movement."
}