CVE-2026-12168: Little Orbit GFAC Driver Privilege Escalation – Kernel Code Execution

Technical summary

CVE-2026-12168 is an improper input validation vulnerability in the GFAC_Sys_x64.sys kernel driver. The driver exposes a Minifilter communication port that does not adequately validate crafted messages from local callers. This allows a low-privileged local process to send specially crafted input that bypasses security checks, leading to arbitrary code execution in kernel context. The vulnerability affects the x64 variant of the driver and requires no special privileges to trigger—any authenticated local user can initiate the attack.

Business impact

Successful exploitation results in complete system compromise. An attacker gains SYSTEM-level code execution, allowing them to disable security controls, install persistent malware, exfiltrate sensitive data, modify audit logs, and maintain long-term access. For enterprise environments, this represents a critical path to lateral movement and data breach if the affected driver is deployed across endpoints or servers.

Affected systems

Systems running Little Orbit GFAC with the GFAC_Sys_x64.sys driver are at risk. This includes 64-bit Windows installations where GFAC is deployed. Organizations should audit their environment to identify which machines have this driver loaded. Verify against Little Orbit's official advisory for definitive product versions and scope.

Exploitability

Exploitation requires local access but no special privileges—any logged-in user can trigger the vulnerability. The attack is deterministic; the CVSS vector indicates low attack complexity (AC:L), meaning no special conditions or timing are required. No user interaction is needed. However, the vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no public exploit code has been disclosed at this time.

Remediation

Contact Little Orbit for a security update addressing improper input validation in GFAC_Sys_x64.sys. Patches should be tested in a non-production environment before rollout. Until a patch is available, restrict driver loading to trusted system accounts, disable the Minifilter communication port if functionality permits, and monitor for suspicious local process behavior. Verify patch availability and version numbers directly with Little Orbit's security advisory.

Patch guidance

Check Little Orbit's official security advisories for patched driver versions. Apply patches immediately to systems where GFAC is in use, prioritizing machines handling sensitive data or serving as network access points. Test patches in a staging environment to ensure no compatibility issues with dependent applications. Document the patch deployment date and confirm driver version post-update. If Little Orbit has not yet released a fix, escalate to their support team for an estimated timeline.

Detection guidance

Monitor for processes opening handles to the GFAC Minifilter communication port and sending non-standard messages. Log failed and successful driver load events. Use kernel-mode debugging or ETW (Event Tracing for Windows) to capture IPC activity on Minifilter ports. Endpoint Detection and Response (EDR) tools should alert on unexpected kernel-mode code execution originating from user-mode processes. Check for GFAC_Sys_x64.sys loaded in kernel memory on all Windows systems, especially those not requiring the driver operationally.

Why prioritize this

This vulnerability merits urgent remediation. A CVSS 7.8 (HIGH) rating reflects the combination of local attack vector, low complexity, and complete impact across confidentiality, integrity, and availability. Unlike many local privilege escalation flaws, this one provides direct kernel code execution without exploit complexity. Any system where GFAC is unnecessary should have the driver unloaded immediately. Systems requiring GFAC should receive patched versions as soon as available.

Risk score, explained

The score of 7.8 reflects a locally exploitable vulnerability with high severity. The vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates: local attack vector (AV:L), low attack complexity (AC:L), low privilege requirement (PR:L), no user interaction (UI:N), and complete impact on confidentiality, integrity, and availability (C:H, I:H, A:H). The lack of scope change (S:U) and the local-only attack surface prevent a critical rating, but the impact severity and ease of exploitation warrant immediate attention.

Frequently asked questions