Arbitrary Kernel Memory Write in Little Orbit GFAC GFAC_Sys_x64.sys

CVE-2026-12168 is an improper validation vulnerability in the Little Orbit GFAC kernel driver GFAC_Sys_x64.sys. The driver processes messages received through a Minifilter communication port without properly validating user-supplied memory addresses before performing write operations. By sending a crafted request that supplies an attacker-controlled destination address and data value, a local attacker can trigger an arbitrary kernel memory write (write-what-where condition). The issue can then be leveraged to modify sensitive kernel or operating system structures, including process security tokens, enabling privilege escalation and potentially arbitrary code execution in kernel mode.