CVE-2026-129255 in MASTERPLUS+
Summary
by MITRE • 11/14/2026
A vulnerability was identified in CoolerMaster MASTERPLUS+ 1.9.6. This affects the function sub_11504 in the library WinRing0x64.sys of the component Device Driver. The manipulation of the argument PhysicalAddress leads to incorrect default permissions. The attack can only be performed from a local environment. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/14/2026
The vulnerability identified within CoolerMaster MASTERPLUS+ version 1.9.6 represents a significant security flaw rooted in the underlying device driver architecture, specifically affecting the WinRing0x64.sys library. This component serves as an interface between user-space applications and hardware-level operations, allowing software to perform privileged I/O port access and memory manipulation. The specific defect resides within the function sub_11504, where improper handling of the PhysicalAddress argument results in a failure to enforce correct default permissions. In secure system design, when accessing physical memory or hardware registers through kernel-mode drivers, strict validation of input parameters is mandatory to prevent unauthorized access patterns. Here, the lack of rigorous permission checks allows an attacker who has already gained local execution privileges to exploit this misconfiguration for further privilege escalation or unauthorized hardware interaction.
From a technical perspective, this flaw aligns with CWE-284, which describes Improper Access Control vulnerabilities where insufficient restrictions are applied to interactions between components. The manipulation of the PhysicalAddress argument suggests that the driver fails to validate whether the requesting process has the necessary rights to access the specified physical memory region or I/O port range. This is particularly dangerous because WinRing0x64.sys operates with high privileges, often equivalent to SYSTEM level access on Windows systems. By exploiting this permission bypass, a local attacker can potentially read sensitive kernel data structures, modify hardware settings such as fan speeds or voltage levels in ways that could cause physical damage, or execute arbitrary code within the kernel space. The absence of proper security checks creates an attack surface where standard user-level processes can escalate their privileges by leveraging the driver's elevated trust level without adequate verification.
The operational impact of this vulnerability is constrained to local environments, meaning a remote attacker cannot exploit it over a network connection directly. However, in many scenarios involving system administration tools or gaming peripherals like those managed by CoolerMaster, users often run such utilities with administrative privileges or as part of services that start automatically at boot. If an attacker can achieve even basic user-level code execution on the target machine through other means, this driver vulnerability provides a reliable path to gain full control over the operating system. This could lead to complete data compromise, installation of persistent malware, or use of the compromised host for further attacks against networked systems. The fact that the vendor did not respond to early disclosure attempts exacerbates the risk, as it leaves users without official patches or workarounds, forcing them to rely on manual mitigation strategies such as disabling the service if not actively needed or restricting execution permissions via Windows Defender Application Control policies.
To mitigate this vulnerability in the absence of a vendor patch, administrators should consider implementing strict access controls over the WinRing0x64.sys binary itself. This includes ensuring that only trusted applications have execute and read permissions for the driver file located on disk. Additionally, monitoring for unusual I/O port accesses or memory reads by non-system processes can help detect exploitation attempts in real-time using endpoint detection and response tools. From a broader security architecture standpoint, this incident highlights the risks associated with third-party kernel-mode drivers that lack rigorous code review and secure development lifecycle practices. Organizations should audit their use of such utilities, preferring alternatives that do not require loading unsigned or poorly maintained kernel modules whenever possible. The behavior observed here also maps to MITRE ATT&CK techniques related to privilege escalation via driver exploitation, emphasizing the need for continuous monitoring of system integrity and strict adherence to least-privilege principles in endpoint configurations.