CVE-2026-57851: MSI Feature Manager Kernel Privilege Escalation (CVSS 7.8 HIGH)

Technical summary

CVE-2026-57851 is a local privilege escalation vulnerability residing in the KernCoreLib64.sys kernel driver component of MSI Feature Manager. The vulnerability stems from insufficiently protected IOCTL (Input/Output Control) handlers that expose sensitive kernel operations to unprivileged users. A locally authenticated user can invoke these IOCTL handlers without administrative credentials to perform arbitrary reads and writes to physical memory and unrestricted I/O port operations. This capability enables manipulation of kernel data structures, modification of kernel-mode callbacks, circumvention of Protected Process Light (PPL) mechanisms, and interference with security software functionality. The attack surface is local-only, requiring prior logon access, but the lack of privilege requirements and straightforward exploitation path make this a significant kernel-level threat.

Business impact

Compromise of systems running vulnerable versions of MSI Feature Manager exposes organizations to critical operational and security risks. An insider threat or attacker with local machine access can disable endpoint security controls, rendering traditional detection mechanisms ineffective. This enables follow-on attacks—lateral movement, data exfiltration, or malware installation—without visibility or prevention. For organizations relying on MSI products in their hardware or software stack, this vulnerability could necessitate emergency patching, security audits of potentially compromised systems, and incident response activities. The ability to bypass Protected Process Light protections is particularly concerning for enterprises managing high-security workloads.

Affected systems

MSI Feature Manager is affected; however, the provided source data does not specify which versions of the product are vulnerable. Organizations using MSI Feature Manager should check the MSI security advisory for precise version ranges and affected configurations. The vulnerability requires local system access to exploit, so air-gapped or restricted-access systems face lower immediate risk, but any system with regular user logon privileges is in scope.

Exploitability

The vulnerability is relatively straightforward to exploit once local access is obtained. An attacker needs only user-level privileges—no administrative elevation is required—and the IOCTL handlers are directly accessible through standard kernel device object interactions. No user interaction or complex preconditions are required. However, exploitation does require prior local logon access to the target system. The absence of in-the-wild confirmed exploitation should not be taken as evidence of low exploitability; the technical simplicity and powerful capabilities make this an attractive target for both targeted attacks and insider threats.

Remediation

Apply the security patch released by MSI for KernCoreLib64.sys. Organizations should prioritize systems with high-value data, security-sensitive roles, or elevated user access. Verify the specific patch version against MSI's official security advisory before deployment. Until patching is complete, mitigate risk by restricting local logon privileges to trusted users, disabling MSI Feature Manager if not actively required, or limiting access to systems running the vulnerable driver through physical or network controls.

Patch guidance

Consult the official MSI security bulletin for the correct patch version and deployment method. Test patches in a non-production environment first, particularly given the kernel-level nature of the fix. Patch rollout should prioritize critical infrastructure, servers, and workstations with sensitive data access. Organizations should verify patch installation by confirming the driver file version in System Information or via automated inventory tools. Consider a phased rollout to avoid widespread service disruption.

Detection guidance

Monitor for direct access attempts to the vulnerable kernel driver device object and IOCTL requests that perform memory read/write or I/O port operations from non-system processes. Endpoint Detection and Response (EDR) solutions capable of kernel-level telemetry can flag suspicious kernel driver communication patterns. Log authentication attempts and session creation for high-value systems. Review Windows Event Log for unusual privilege-related events post-compromise. If security software disablement is suspected, cross-reference system logs with anomalous process terminations or service stops.

Why prioritize this

This vulnerability merits urgent attention due to its combination of high impact and low exploitation barriers. The CVSS 3.1 score of 7.8 (HIGH) reflects the severity: local access only, but complete confidentiality, integrity, and availability impact once exploited. The ability to disable security controls and manipulate kernel structures makes post-exploitation activity difficult to detect and remediate. Any organization with MSI Feature Manager in production should treat patching as a critical priority, particularly if users have broad logon access.

Risk score, explained

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) yields a score of 7.8 (HIGH). Attack Vector is Local, reflecting the requirement for prior system access. Attack Complexity is Low, indicating straightforward exploitation once local access is obtained. Privileges Required is Low—standard user credentials suffice. User Interaction is None. Scope is Unchanged. All impact metrics (Confidentiality, Integrity, Availability) are High because the attacker gains memory access, control over kernel operations, and can disable system functions. The score appropriately captures the critical nature of the vulnerability while acknowledging the local-only attack surface.

Frequently asked questions