Description

A vulnerability was found in Moore Threads MTT S80 Driver Package 340.150. The affected element is the function sub_140006F0C in the library mtdispkm64.sys of the component IOCTL Handler. The manipulation results in improper privilege management. Attacking locally is a requirement. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-21T23:16:56.697Z",
  "pubdate": "2026-09-21T23:16:56.697Z",
  "executiveSummary": "A critical vulnerability categorized as improper privilege management exists within the Moore Threads MTT S80 driver package, specifically version 340.150.\nThe vulnerability resides in the IOCTL handler component within the mtdispkm64.sys kernel-mode driver.\nSuccessful exploitation allows a local, authenticated attacker to escalate privileges or perform unauthorized operations by interacting with the vulnerable IOCTL handler.\nThe lack of adequate access control checks permits an attacker to interface with functionality intended for high-privilege execution, potentially leading to arbitrary kernel-mode code execution or system compromise.\nThe vendor, Moore Threads, remains unresponsive to disclosure efforts, leaving the vulnerability unpatched in the specified version.\nThe attack is constrained to local access, requiring the attacker to have an existing foothold on the host system to interact with the device driver.",
  "technicalDetails": "The vulnerability is located within the function sub_140006F0C, housed inside the mtdispkm64.sys kernel driver component of the Moore Threads MTT S80 driver package version 340.150.\nThe root cause is identified as improper privilege management within the IOCTL (Input/Output Control) dispatch routine. Specifically, the function sub_140006F0C fails to implement appropriate validation or security checks to ensure that the calling process possesses the necessary security descriptors or administrative privileges required to invoke sensitive kernel operations.\nIn the Windows kernel architecture, device drivers expose IOCTLs to user-mode applications to facilitate hardware-specific communication. The mtdispkm64.sys driver exposes an interface that sub_140006F0C handles. Because the handler lacks adequate validation of the requester's context, an attacker can construct a crafted IOCTL request sent via the DeviceIoControl API.\nThe attack flow follows a structured exploitation pattern: 1. The attacker initializes a handle to the vulnerable device using CreateFile on the device object associated with the Moore Threads driver. 2. The attacker prepares a buffer containing a malicious payload or specially crafted parameters designed to exploit the logic flaw within sub_140006F0C. 3. The attacker issues a DeviceIoControl request to the driver, directing the execution flow into the vulnerable function. 4. Due to the absence of access control, the driver processes the request with elevated kernel-mode privileges.\nThe exploitation of this function can lead to memory corruption, improper access to protected kernel structures, or the execution of arbitrary code in Ring 0. Post-exploitation, an attacker can achieve privilege escalation, allowing for the bypassing of security constraints, disabling of endpoint protection, or persistence at the kernel level. Since the function executes in the context of the kernel, successful manipulation grants the attacker complete control over the system, assuming they can successfully trigger the faulty logic within the function's internal flow control.\nNo authentication or specific elevation is required at the time of the call, as the driver accepts inputs from local user-mode processes without sufficient authorization gating."
}