HighPublic exploit

Local Privilege Escalation in MSI Feature Manager KernCoreLib64.sys

IdentifiersCVE-2026-57851CWE-782· Exposed IOCTL with Insufficient…

CVE-2026-57851 is a local privilege escalation vulnerability in MSI Feature Manager involving the KernCoreLib64.sys kernel driver. The driver exposes IOCTL handlers through an accessible device object without requiring administrator privileges, allowing a locally logged-on user to invoke functionality that should be restricted. Successful exploitation permits arbitrary physical memory read and write operations as well as unrestricted I/O port access from user-controlled context. Because the vulnerable functionality executes in kernel context, an attacker can use these primitives to directly manipulate kernel memory and system state, making the flaw suitable for elevation of privilege and security control bypass.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows a local attacker to escalate privileges to kernel-level control. With arbitrary physical memory access and unrestricted I/O port operations, an attacker can manipulate kernel objects, tamper with kernel-mode callbacks, bypass Protected Process Light protections, and disable or interfere with security software. The resulting impact includes full compromise of confidentiality, integrity, and availability on the affected host.

Mitigation

If you can’t patch tonight, do this now.

Restrict local access to affected systems to trusted users only, since exploitation requires a locally logged-on account. Reduce attack surface by uninstalling MSI Feature Manager where it is not required, blocking or disabling the vulnerable driver, and enforcing application control policies that prevent untrusted code from interacting with the driver. Monitor for attempts to access the driver from low-privilege processes and for signs of kernel tampering or security product interference.

Remediation

Patch, then assume compromise.

Apply a vendor-provided update for MSI Feature Manager or the affected KernCoreLib64.sys driver that restricts access to privileged IOCTL functionality and removes arbitrary physical memory and unrestricted I/O port access from unprivileged users. If no fixed version is available, remove or disable the vulnerable component where operationally feasible.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 1 / 1 TOTALView more in app

MSI_FeatureManager_CVEMaturityOperationalVerified exploit

This repository is a Visual Studio C++ proof-of-concept for abusing a vulnerable Windows kernel driver identified in the README as KernCoreLib64.sys and exposed through the device name \\.\WinIo. The solution contains two standalone console projects: io_port and phys_mem. Both are local post-compromise tools rather than remote exploits. The io_port project is a capability demonstration for raw hardware access. It opens the driver device and uses DeviceIoControl with IOCTL_READ_IO_PORT (0x80102050) and IOCTL_WRITE_IO_PORT (0x80102054) to access PCI configuration ports 0xCF8 and 0xCFC. It writes a PCI config address value (0x80000000) and reads back vendor/device IDs for bus 0, device 0, function 0, then prints whether the chipset appears to be Intel or AMD. This demonstrates that the driver exposes unrestricted I/O port primitives. The phys_mem project is the actual privilege-escalation PoC. It opens the same driver and uses IOCTL_MAP_PHYS_MEM (0x80102040) to map physical memory starting at 0xFC000800. The code comments indicate the driver performs insufficient validation on the mapping size, allowing a very large mapping up to essentially all installed RAM. The program then walks the mapped physical memory in 8-byte increments looking for candidate EPROCESS structures using heuristics such as plausible PID values, valid CreateTime ranges, and other structure checks. It is tuned for Windows 11 25H2 with hardcoded EPROCESS/KPROCESS offsets. Once it identifies both the SYSTEM process and the current process, it reads their token fields and overwrites the current process token with the SYSTEM token, then verifies success by invoking whoami before and after the write. Repository structure is minimal: one solution file, two C++ source files, two Visual Studio project files plus filters for each project, and a short README with screenshots. There is no exploit framework, no networking, and no configurable payload delivery. The main purpose is to demonstrate vulnerable-driver abuse primitives leading to local privilege escalation through physical memory access and token stealing.

readmsrDisclosed Jun 24, 2026cppxmllocal

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Icu-ProjectInternational Components For Unicodeapplication

MsiFeature Managerapplication

MsiKerncorelib64.Sysoperating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

cvefeed high severityNews

Jul 7, 2026

CVE-2026-57851 - MSI KernCoreLib64.sys Privilege Escalation via IOCTL Handlers

A local privilege escalation vulnerability in MSI Feature Manager's KernCoreLib64.sys kernel driver that exposes IOCTL handlers, allowing a locally logged-on user to perform arbitrary physical memory read/write and unrestricted I/O port operations, enabling kernel tampering and security bypasses.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity3