Description

A vulnerability has been found in Moore Threads MTT S80 Driver Package up to 340.150. Impacted is the function sub_140001000 in the library mtdispkm64.sys of the component IOCTL Handler. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-21T21:17:21.793Z",
  "pubdate": "2026-09-21T21:17:21.793Z",
  "executiveSummary": "A critical heap-based buffer overflow vulnerability has been identified within the Moore Threads MTT S80 Driver Package, specifically residing in the mtdispkm64.sys kernel-mode driver.\nThe vulnerability manifests within the IOCTL Handler function sub_140001000, which fails to properly validate the size of user-supplied data before copying it into a fixed-size kernel heap buffer.\nThis flaw allows a local, authenticated attacker to trigger memory corruption, potentially leading to local privilege escalation (LPE) or a system-wide kernel panic (BSOD).\nBecause the driver operates in kernel mode (Ring 0), successful exploitation grants the attacker significant control over the operating system, bypassing standard user-land security boundaries.\nThe vulnerability is currently unpatched, as the vendor has failed to respond to disclosure attempts. System administrators should treat this as a high-risk security flaw for any environment utilizing Moore Threads MTT S80 graphics hardware.",
  "technicalDetails": "The vulnerability is a classic heap-based buffer overflow located in the IOCTL dispatcher of the mtdispkm64.sys driver, specifically within the function identified as sub_140001000.\nThe root cause is improper bounds checking when processing IOCTL requests from user-mode applications. When an application sends a specific IOCTL code to this driver, the dispatcher handles the input buffer without verifying that the length of the input data aligns with the destination buffer allocated on the kernel heap.\nThe attack flow begins with a local attacker crafting a malicious IOCTL request. The attacker must first obtain a handle to the device object created by mtdispkm64.sys using CreateFileA/W. Once the handle is obtained, the attacker utilizes the DeviceIoControl function to pass an overly long buffer.\nInside sub_140001000, the driver logic moves the user-provided data into a pre-allocated kernel heap buffer. Because the length check is either missing or incorrectly implemented, the `memcpy` (or similar memory operation) proceeds to overwrite adjacent memory structures on the kernel heap.\nBy controlling the contents of the overflowed buffer, an attacker can overwrite critical kernel objects, such as object headers, function pointers, or data structures used by the Windows kernel memory manager.\nExploitation requires the attacker to have already gained initial code execution on the target system (e.g., as a low-privileged user). The complexity of exploitation involves heap spraying or grooming to place predictable data at the destination memory address, followed by the execution of a payload that diverts kernel execution flow.\nSuccessful exploitation results in arbitrary code execution in the kernel context. This effectively allows the attacker to disable security software, install persistent rootkits, or exfiltrate data from protected kernel memory. Given the nature of the heap overflow, the most common immediate impact is a system crash due to memory corruption, though weaponization is highly feasible for a sophisticated actor."
}