CVE-2026-129261 in FURY CTRL RGB Control Software
Summary
by MITRE • 11/14/2026
A vulnerability was found in Kingston FURY CTRL RGB Control Software up to 2.0.66.0. The impacted element is an unknown function in the library NTIOLib_X64.sys of the component IOCTL Handler. Performing a manipulation results in exposed ioctl with insufficient access control. The attack is only possible with local access.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/14/2026
The Kingston FURY CTRL RGB Control Software, specifically versions up to 2.0.66.0, contains a critical security flaw within its underlying driver architecture that compromises system integrity through improper handling of input/output control codes. This vulnerability resides in the NTIOLib_X64.sys kernel-mode driver, which serves as an intermediary between user-space applications and hardware components for RGB lighting control. The core issue stems from insufficient access controls applied to specific IOCTL handlers within this library. In a properly secured system, operations that interact directly with hardware or modify low-level system states must be strictly gated by privilege checks to ensure only authorized processes can execute them. However, in this implementation, the driver fails to adequately verify the security context of the calling process before processing certain ioctl requests. This oversight creates an avenue for local attackers who have already gained a foothold on the target machine to exploit these exposed interfaces without requiring elevated privileges or remote access vectors.
From a technical perspective, the flaw represents a classic case of improper privilege management within kernel-mode drivers. When a user-space application issues an IOCTL request, the operating system passes this call down to the driver's dispatch routine. Ideally, the driver should validate that the caller possesses the necessary administrative rights before executing sensitive operations such as writing to hardware registers or modifying memory structures associated with peripheral devices. In the case of NTIOLib_X64.sys, the lack of rigorous access control checks allows any local process, regardless of its privilege level, to invoke these functions. This effectively bypasses standard Windows security boundaries that are designed to prevent lower-privilege processes from interfering with system-critical components or other applications. The vulnerability is not triggered by malformed input data but rather by the unauthorized invocation of valid commands due to missing authorization logic in the driver's entry points.
The operational impact of this vulnerability is significant for any environment where local access can be achieved, even if limited. An attacker who has obtained basic user-level access on a compromised workstation or server could leverage this flaw to escalate privileges or disrupt system stability. By manipulating these exposed ioctl functions, an adversary might be able to alter the state of RGB hardware controllers in ways that are not intended by the software vendor, potentially leading to denial-of-service conditions if critical registers are corrupted. More critically, depending on how the driver interacts with other system components, this flaw could serve as a stepping stone for further exploitation. For instance, manipulating kernel-mode memory or device states might allow an attacker to inject code, hijack execution flow, or access sensitive data protected by higher privilege levels. This undermines the principle of least privilege and weakens the overall security posture of the endpoint.
This vulnerability aligns with CWE-269, which classifies Improper Privilege Management, specifically highlighting scenarios where software does not properly assign privileges to actors based on their authorization level. Furthermore, in the context of the MITRE ATT&CK framework, this flaw facilitates techniques related to Local Privilege Escalation and potentially Defense Evasion if used to bypass security controls that rely on process integrity checks. The fact that the attack requires local access means it is typically relevant in scenarios involving physical theft, insider threats, or after an initial compromise via phishing or web application attacks where the attacker has established a persistent presence on the machine but lacks administrative rights.
To mitigate this risk, users of Kingston FURY CTRL RGB Control Software should immediately update to version 2.0.66.1 or later, where these access control issues have been addressed by the vendor. Until an official patch is applied, administrators can consider restricting the execution permissions of NTIOLib_X64.sys using Windows Access Control Lists (ACLs) to limit which users and groups can load or interact with the driver. Additionally, implementing strict application whitelisting policies can prevent unauthorized processes from invoking system calls that might trigger these vulnerable code paths. Regular monitoring for unusual kernel-mode activity and ensuring that all peripheral control software is kept up-to-date are essential practices for maintaining a secure computing environment against such local exploitation vectors.