Description

A weakness has been identified in ColorFul iGameCenter 1.0.3.4. This impacts the function sub_140001AF0 in the library ene.sys of the component IOCTL Handler. This manipulation causes untrusted pointer dereference. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-21T19:17:19.867Z",
  "pubdate": "2026-09-21T19:17:19.867Z",
  "executiveSummary": "A critical security vulnerability has been identified in the ColorFul iGameCenter version 1.0.3.4, specifically within the kernel-mode driver ene.sys.\nThe vulnerability is classified as an untrusted pointer dereference originating from the driver's IOCTL (Input/Output Control) handler, specifically residing within the sub_140001AF0 function.\nThe flaw allows a local, authenticated attacker to manipulate memory operations, potentially leading to arbitrary kernel-mode code execution or system instability.\nThe risk is elevated due to the public availability of exploit code, which facilitates rapid weaponization by malicious actors.\nSince the vulnerability resides in a kernel driver, successful exploitation bypasses standard user-mode security boundaries, granting an attacker elevated privileges equivalent to the NT AUTHORITY\\SYSTEM account.\nDespite prior attempts at responsible disclosure, the vendor has failed to provide a response or a corrective patch.\nThis vulnerability is strictly limited to local attack vectors, requiring the attacker to already possess a foothold on the target machine.",
  "technicalDetails": "The vulnerability exists in the ene.sys kernel driver, a component responsible for hardware communication within the ColorFul iGameCenter ecosystem.\nThe root cause is an improper validation of user-supplied pointers within the IOCTL handler function sub_140001AF0.\nIn the Windows kernel architecture, IOCTLs provide a communication bridge between user-mode applications and kernel-mode drivers. The ene.sys driver fails to sufficiently sanitize input buffers or validate memory addresses passed via these IOCTL requests.\nThe specific mechanism involves the sub_140001AF0 function performing operations on memory addresses provided by the calling process without verifying if the pointers reference kernel-mode memory or user-mode memory.\nAn attacker can craft a malicious IOCTL request containing a pointer that targets kernel-space memory addresses. When the driver processes this request, it attempts to dereference the tainted pointer. This results in the kernel reading or writing data at arbitrary locations in kernel memory.\nThe attack flow follows a structured path: first, the attacker gains local access and initializes a handle to the vulnerable device object associated with ene.sys. Second, the attacker prepares a custom IOCTL buffer where the control structures contain malicious pointers designed to bypass ASLR (Address Space Layout Randomization) and target sensitive kernel structures.\nUpon transmission of the DeviceIoControl call, the driver executes the compromised sub_140001AF0 logic. The pointer dereference operation triggers an out-of-bounds write or read, allowing the attacker to overwrite critical structures such as the System Token or function pointers in the kernel dispatch tables.\nExploitation leads to immediate privilege escalation, as the attacker can overwrite their own process's security token to match that of the System process. Furthermore, by overwriting kernel function pointers (such as HalDispatchTable), an attacker can redirect the execution flow to shellcode placed in kernel space.\nBecause the driver runs with high integrity, any failure in handling the memory access results in a Blue Screen of Death (BSOD), facilitating a Denial of Service (DoS) if privilege escalation is not the primary objective.\nThe lack of vendor response means this vulnerability remains unpatched in the 1.0.3.4 release, leaving systems vulnerable to any local attacker capable of invoking the driver's device interface."
}