Submit #894806: MOORE THREADS MTT S80 driver package v340.150 Buffer Overflow

A critical heap-based buffer overflow flaw was identified within the kernel-mode graphic driver mtdispkm64.sys (SHA256: dad38c813c585d89c27668f42ae537546b00cae1f6b4c8a27d7932fef287211d), bundled with the Moore Threads (MOORE THREADS) MTT S80 driver package v340.150.
Inside DriverEntry, the driver creates a kernel device object at \Device\mtdispkm64. When a local process sends the I/O control code (IOCTL) 0x222404 to the central dispatch routine sub_14000137C, the driver completely fails to enforce any buffer length validation on the user-supplied input or output buffers.
The driver blindly forwards the raw SystemBuffer pointer to the setup initialization routine sub_140001000. Upon execution, sub_140001000 instantly invokes an internal zero-fill primitive to clear a fixed size of 552 bytes (0x228u). If the caller supplies a buffer shorter than 552 bytes, the driver forces an out-of-bounds write, directly corrupting adjacent active memory allocation blocks inside the NonPaged Pool. A local, unprivileged attacker can leverage this unchecked zero-fill primitive to consistently trigger a systemic Kernel Page Fault leading to an immediate Denial of Service (BSOD / DoS), or weaponize it to achieve Local Privilege Escalation (LPE).
Credit:
This vulnerability was discovered and analyzed by ElementXu ([email protected]).

• User: Element2023H (UID 99757)
• Submission: 07/18/2026 08:00 (2 months ago)
• Moderation: 09/21/2026 17:38 (2 months later)
• Status: Accepted
• VulDB entry: 408150 [Moore Threads MTT S80 Driver Package up to 340.150 IOCTL mtdispkm64.sys sub_140001000 heap-based overflow]
• Points: 17