CVE-2026-12166: GFAC_Sys_x64.sys NULL Pointer Dereference DoS Vulnerability

Technical summary

A NULL pointer dereference flaw exists in the GFAC_Sys_x64.sys kernel driver used by Little Orbit GFAC. When the driver processes malformed requests without proper validation, it attempts to dereference a NULL pointer, triggering a kernel exception and system crash. The vulnerability requires local code execution privileges to trigger and does not grant elevation of privilege or code execution in itself. The CVSS v3.1 score of 5.5 (MEDIUM) reflects the local attack vector, low complexity, and impact limited to availability.

Business impact

Systems running Little Orbit GFAC are susceptible to local denial-of-service attacks that can crash the host. For organizations relying on GFAC for critical processes, an attacker with local access (employee, contractor, or compromised account) could disable the system. This is most concerning in environments where GFAC manages important workflows or where downtime carries operational cost. The impact is availability-focused; data confidentiality and integrity are not at direct risk from this vulnerability.

Affected systems

Little Orbit GFAC installations using the GFAC_Sys_x64.sys driver on 64-bit Windows systems are affected. The vulnerability description does not specify which versions of GFAC are impacted. Organizations running GFAC should consult the vendor advisory to determine which releases contain the vulnerable driver and which patched versions are available.

Exploitability

Exploitation requires local system access and local privilege level (PR:L in the CVSS vector), meaning the attacker must already have a user account or code execution context on the target machine. No remote exploitation is possible. The attack has low complexity (AC:L), indicating that crafting the malicious request does not require specialized techniques or race conditions. For a local attacker, this is relatively straightforward to weaponize if they have system access; however, the local requirement significantly reduces the overall threat surface compared to remote vulnerabilities.

Remediation

The primary remediation is to apply a patch from Little Orbit that addresses the NULL pointer dereference. Organizations should contact Little Orbit support or check their advisory for patched driver versions. In the interim, restrict local system access to trusted users and monitor for suspicious driver interactions. If GFAC can be temporarily disabled without critical impact, that may be a short-term risk mitigation while awaiting the patch.

Patch guidance

Contact Little Orbit directly or monitor their official security advisories for a patched version of GFAC_Sys_x64.sys. Once available, test the patch in a non-production environment to confirm it resolves the vulnerability and does not introduce compatibility issues. Deploy to production systems according to your change management schedule. Verify that the patched driver version is loaded after system reboot to ensure the update took effect.

Detection guidance

Monitor kernel crash dumps (bugcheck events, code 0xC0000005 EXCEPTION_ACCESS_VIOLATION) and system event logs for unexpected GFAC_Sys_x64.sys driver crashes. Endpoint detection and response (EDR) solutions should flag abnormal driver behavior or repeated crash cycles. Because the vulnerability is triggered by crafted requests to the driver, monitor for unusual or repeated calls to GFAC driver interfaces from untrusted processes. Baselining normal GFAC driver activity will help identify anomalies.

Why prioritize this

Although CVSS 5.5 is classified as MEDIUM, this vulnerability merits prompt attention in environments where GFAC is mission-critical or where local threat actors (insiders, third-party vendors) have system access. Organizations with strong local access controls and limited local user populations may deprioritize this lower than a remote vulnerability, but the ease of exploitation for local attackers should not be underestimated. Prioritize patching in high-availability or sensitive environments.

Risk score, explained

CVSS 5.5 reflects the combination of a local-only attack vector (reducing attack surface), low complexity exploitation, and high availability impact. There is no confidentiality or integrity breach possible. The score is not higher because local privilege is required, limiting the attacker pool. However, it is not lower because a single crafted request can reliably crash a critical system component, and the fix requires vendor patching.

Frequently asked questions