CVE-2026-94424 in MTT S80 Driver Package
Summary
by MITRE • 09/21/2026
A vulnerability has been found in Moore Threads MTT S80 Driver Package up to 340.150. Impacted is the function sub_140001000 in the library mtdispkm64.sys of the component IOCTL Handler. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/21/2026
The Moore Threads MTT S80 Driver Package, specifically versions up through 340.150, contains a critical security flaw within its kernel-mode display driver component known as mtdispkm64.sys. This vulnerability resides in the IOCTL handler subsystem, which is responsible for processing input/output control codes sent from user-space applications to the operating system's kernel. The specific point of failure is identified within the function sub_140001000, where improper validation or bounds checking allows an attacker to trigger a heap-based buffer overflow. This type of memory corruption vulnerability occurs when data written to a dynamically allocated region on the heap exceeds its designated boundary, overwriting adjacent memory structures and potentially corrupting critical system state information.
From a technical perspective, this flaw represents a classic CWE-122: Heap-based Buffer Overflow scenario. In kernel-mode drivers, such vulnerabilities are particularly dangerous because they allow for arbitrary code execution with high privileges if the overflow can be precisely controlled to overwrite function pointers or object headers on the heap. The IOCTL handler serves as a primary attack surface since it exposes internal driver functionality to user-space processes. When an application sends a crafted control code containing oversized input data, the vulnerable function fails to adequately check the length of this input against the allocated buffer size. This lack of rigorous boundary verification enables malicious actors to write beyond the intended memory limits, leading to potential system instability or complete compromise depending on how the overwritten memory is utilized by subsequent kernel operations.
The operational impact of this vulnerability is severe due to its location within a core graphics driver that runs with SYSTEM-level privileges in Windows environments. Although the exploitation vector requires local access, meaning an attacker must already have authenticated access to the machine, the privilege escalation potential makes it a significant risk for insider threats or compromised user accounts. An adversary could leverage this flaw to execute arbitrary code in kernel space, bypassing standard security controls such as User Account Control and Data Execution Prevention. This capability effectively grants full control over the operating system, allowing for data exfiltration, installation of persistent backdoors, or use of the machine as a pivot point within a network infrastructure. The fact that the vendor has not responded to early disclosure attempts exacerbates the risk, leaving users without official patches or workarounds and forcing reliance on community-driven mitigations or driver version management.
To mitigate this vulnerability in the absence of an immediate patch from Moore Threads, administrators should consider restricting local access to systems running the affected driver versions where possible. Implementing strict application whitelisting policies can prevent unauthorized user-space applications from interacting with the display driver's IOCTL interface. Additionally, enabling kernel-mode exploit protection features such as Kernel Address Space Layout Randomization and Control Flow Guard may reduce the likelihood of successful exploitation by making memory layout unpredictable and enforcing valid control flow paths. Monitoring for unusual process behavior or privilege escalation attempts using endpoint detection and response tools can also help identify potential exploitation activities in real time. Until a vendor-supplied fix is released, keeping track of community advisories and considering alternative graphics drivers if feasible remains the most prudent course of action to maintain system integrity.