CVE-2026-94425 in MTT S80 Driver Package
Summary
by MITRE • 09/22/2026
A vulnerability was found in Moore Threads MTT S80 Driver Package 340.150. The affected element is the function sub_140006F0C in the library mtdispkm64.sys of the component IOCTL Handler. The manipulation results in improper privilege management. Attacking locally is a requirement. The vendor was contacted early about this disclosure but did not respond in any way.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified within the Moore Threads MTT S80 Driver Package version 340.150 represents a critical security flaw located specifically within the kernel-mode driver module mtdispkm64.sys. This component serves as the IOCTL handler for display-related operations, acting as an intermediary between user-space applications and the underlying hardware abstraction layer. The specific point of failure is identified in the function sub_140006F0C, which processes input control codes sent to the driver. In a properly secured system, kernel drivers must rigorously validate all inputs from untrusted sources before performing any privileged operations. However, analysis reveals that this particular routine fails to enforce adequate access controls or privilege checks when handling specific IOCTL requests. This deficiency allows an attacker who has already gained local execution capabilities on the affected system to manipulate driver behavior in ways intended only for higher-privileged processes or trusted applications.
From a technical perspective, this flaw is classified as improper privilege management, which aligns with Common Weakness Enumeration identifier CWE-269. The core issue lies in the lack of validation regarding the caller's integrity level or security token before executing sensitive kernel routines. When an unprivileged process invokes the vulnerable IOCTL handler, the driver does not sufficiently verify that the requester has the necessary permissions to perform the requested action. This oversight creates a pathway for privilege escalation, where a low-privilege user can execute code with system-level rights. The absence of proper checks means that operations requiring administrative or SYSTEM privileges are effectively accessible to standard users through this specific entry point in the driver's interface.
The operational impact of this vulnerability is severe due to its local exploitation nature and the resulting privilege escalation capability. An attacker who has achieved local access on a vulnerable system can leverage this flaw to elevate their permissions from a standard user account to that of an administrator or even SYSTEM level. This transition grants the attacker unrestricted control over the operating system, including the ability to install software, view, change, or delete any data, and create new accounts with full administrative rights. Furthermore, once elevated privileges are obtained, the attacker can disable security features such as antivirus solutions or firewalls, making subsequent lateral movement within a network significantly easier if the compromised machine is part of a larger infrastructure. The fact that the vendor has not responded to early disclosure attempts exacerbates the risk, leaving users without official patches or workarounds and forcing reliance on community-driven mitigations or system hardening techniques.
In terms of threat modeling, this vulnerability maps directly to MITRE ATT&CK technique T1068 Exploitation for Privilege Escalation. Attackers typically exploit such flaws by crafting malicious IOCTL requests that trigger the vulnerable code path in sub_140006F0C. Since local access is a prerequisite, this attack vector is often utilized after an initial compromise via phishing, web application attacks, or other entry points that allow code execution on the target machine. The lack of vendor response means that defenders must assume active exploitation may occur using publicly available proof-of-concept exploits once details are disseminated in security research communities.
Mitigation strategies for this vulnerability focus primarily on reducing the attack surface and isolating potential damage since a patch is not currently available from Moore Threads. Organizations should restrict local user privileges wherever possible, adhering to the principle of least privilege to ensure that even if an attacker gains initial access, they do so with minimal capabilities. Implementing application whitelisting can prevent unauthorized executables from running, thereby reducing the likelihood of successful exploitation. Additionally, deploying endpoint detection and response solutions that monitor for anomalous kernel-mode activity or unexpected IOCTL calls may help detect attempts to exploit this flaw in real-time. Updating the driver package if a newer version is released by third-party sources or checking for alternative display drivers that do not contain this specific vulnerability can also provide relief. Until official remediation is provided, continuous monitoring and strict access controls remain the most effective defense against exploitation of this improper privilege management issue.