CVE-2026-94403
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A weakness has been identified in ColorFul iGameCenter 1.0.3.4, affecting the function sub_140001AF0 in the ene.sys library of the IOCTL Handler component. This manipulation causes an untrusted pointer dereference. The attack can only be executed locally, and the exploit has been made publicly available.
Risk Assessment
A local attacker could exploit this vulnerability to execute code or destabilize the system with kernel driver privileges. Since the exploit is publicly available, the risk of attack is significantly increased.
Recommendation
Update ColorFul iGameCenter to the latest version as soon as the vendor releases a fix, or consider uninstalling the software until then. Monitor systems for unusual local activity.
Other vulnerabilities in ColorFul iGameCenter
See all- CVE-2026-109520High
A flaw has been found in Colorful iGameCenter 2.0.0.82. Affected by this vulnerability is the function MmMapIoSpace in the library AMDRyzenMasterDriver.sys of the component Dispatch Handler. This manipulation of the argument SystemBuffer causes privilege defined with unsafe actions. The attack needs to be launched locally. The vendor was contacted early about this disclosure but did not respond in any way.
- CVE-2026-82628High
A vulnerability was found in Colorful iGameCenter 2.0.0.81. This vulnerability affects the function sub_11504 in the library WinRing0x64.sys of the component IOCTL Dispatch. Performing a manipulation of the argument PhysicalAddress/AlignNumer/AlignSize results in improper privilege management. Attacking locally is a requirement.
Original NVD description (English source)
A weakness has been identified in ColorFul iGameCenter 1.0.3.4. This impacts the function sub_140001AF0 in the library ene.sys of the component IOCTL Handler. This manipulation causes untrusted pointer dereference. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS