CVE-2026-12167: GFAC Driver Privilege Escalation Vulnerability

Technical summary

CVE-2026-12167 is a privilege escalation vulnerability in the Minifilter communication port exposed by GFAC_Sys_x64.sys. The driver implements a communication interface—likely via a device object or named pipe—that does not enforce adequate discretionary access controls (DAC). A local process running in user-mode with standard privileges can directly communicate with kernel-mode driver functionality without authentication or authorization checks. The vulnerability affects the x64 variant of the system driver in Little Orbit's GFAC product suite. No network-accessible vector exists; exploitation requires local code execution or interactive logon.

Business impact

Compromise of GFAC systems via this vulnerability enables local threat actors or disgruntled insiders to escalate privileges, potentially leading to wholesale system compromise. Attackers could exfiltrate sensitive data handled by GFAC, corrupt or delete logs, disable monitoring, or use the system as a pivot point for lateral movement within a network. Organizations using GFAC for security-sensitive operations face elevated risk of data breach, system unavailability, and compliance violations.

Affected systems

Little Orbit GFAC is affected. Specific version ranges are not provided in available advisories; organizations should consult Little Orbit's official vulnerability guidance to confirm which versions contain the flaw. The vulnerability specifically targets the x64 driver component (GFAC_Sys_x64.sys), so 32-bit deployments may not be affected, but this should be verified with the vendor. Any system with the vulnerable driver installed and local user accounts is potentially exposed.

Exploitability

Exploitability is moderate to high. An attacker must already have local access—either via a legitimate user account or prior code execution as a lower-privileged process. Given the lack of access controls on the communication port, exploitation does not require special techniques once local access is established; any user-mode application can open the port and issue commands. The CVSS score of 7.8 reflects the high-impact consequences (confidentiality, integrity, and availability all affected) but lower attack complexity due to the requirement for prior local access.

Remediation

Apply a patch released by Little Orbit that restricts access to the Minifilter communication port, enforcing authentication and authorization checks. Until patching is feasible, reduce local user access on GFAC systems, disable interactive logon for unnecessary accounts, and use OS-level controls (such as device ACLs or AppLocker) to prevent unauthorized processes from communicating with the driver. Monitor for suspicious device I/O activity targeting the driver interface.

Patch guidance

Check Little Orbit's security advisory and product release notes for patched versions. Patches should include access control enforcement on the communication port, typically via explicit ACL configuration in the driver's device object creation or Minifilter initialization. Test patches in a non-production environment before broad deployment, particularly if GFAC performs critical monitoring or protection functions. Verify that the patched driver is properly signed and loaded.

Detection guidance

Monitor for unexpected access attempts to the GFAC driver device object or communication port via Event Tracing for Windows (ETW), kernel debugging tools, or endpoint detection and response (EDR) agents. Log all user-mode to kernel-mode transitions involving the driver. Watch for process execution by non-system accounts that attempt to open or communicate with the driver. Deploy file integrity monitoring on the driver binary itself to detect tampering or replacement attacks.

Why prioritize this

Although this vulnerability is not yet listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, it carries a HIGH severity rating due to immediate and complete privilege escalation capability and the low barrier to exploitation once local access is gained. Organizations running GFAC should prioritize patching, especially in environments with high user density or elevated insider risk.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) is driven by the attack vector being local (AV:L), low attack complexity (AC:L), low privileges required (PR:L), and high impact across all three categories (C:H, I:H, A:H). The lack of user interaction required (UI:N) and confined scope (S:U) complete the profile. This reflects a serious but not critical issue—serious because once triggered it fully compromises the system, but not critical because it requires pre-existing local access. The HIGH rating warrants prompt attention but does not necessarily override all other security priorities.

Frequently asked questions