CVE-2026-9492
GIGABYTE｜Gigabyte Control Center - Improper Access Control
- State
- Published
- Severity
- 8.5 High
- Published
- Jul 13, 2026
- Updated
- Jul 14, 2026
- Reserved
- May 25, 2026
Description
The MBStorage DRAM lighting control module within Gigabyte Control Center (GCC) developed by GIGABYTE Technology has an Improper Access Control vulnerability. Authenticated local attackers can send specific IOCTL commands through the driver MyPortIO_x64.sys bundled with the module, thereby arbitrarily reading and writing physical memory and obtaining kernel-level privileges.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.5 High | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | twcert |
| 3.1 | 7.8 High | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | twcert |
Weaknesses
- CWE-782 Exposed IOCTL with insufficient access control
Affected Products
| Product | Versions |
|---|---|
MBStorageGIGABYTE |
|
References
- https://www.twcert.org.tw/tw/cp-132-11033-97316-1.htmlthird-party-advisory
- https://www.twcert.org.tw/en/cp-139-11034-f7f2f-2.htmlthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.