Multiple Local Privilege Escalation Vulnerabilities in Little Orbit GFAC Driver (GFAC_Sys_x64.sys)

Summary

The GamersFirst Anti-Cheat (GFAC) kernel-mode driver, GFAC_Sys_x64.sys, exposes privileged functionality to user-mode applications through a minifilter communication port. Insecure handling of user-controlled input received through this port results in multiple local vulnerabilities, ranging from denial-of-service conditions to full privilege escalation to SYSTEM.

Three distinct issues were identified and are tracked together in this advisory:

• CVE-2026-12166 — NULL pointer dereference in driver initialization / request handling, leading to a system crash.
• CVE-2026-12167 — Improper access control on the minifilter communication port, allowing low-privileged users to reach functionality intended only for trusted processes.
• CVE-2026-12168 — Arbitrary kernel memory write ("write-what-where") reachable through the communication port, allowing modification of sensitive kernel structures (e.g. process security tokens) and resulting in privilege escalation to SYSTEM.

Affected Component

• Driver: GFAC_Sys_x64.sys
• Interface: Minifilter communication port exposed to user mode
• Reachability: Standard (non-administrative) local users

Technical Details

CVE-2026-12166 — NULL Pointer Dereference

The driver's initialization and request-handling logic contains a code path that can be driven into dereferencing a NULL pointer by a local, unprivileged caller. Triggering this path causes the driver to read or write through a NULL address, crashing the system (BSOD) and allowing an attacker to repeatedly disrupt availability.

CVE-2026-12167 — Improper Access Control on Communication Port

The minifilter communication port does not enforce a sufficiently restrictive security descriptor. As a result, low-privileged, non-administrative users can open a connection to the port and reach privileged functionality that should be restricted to trusted processes only. This significantly widens the driver's attack surface and is a direct enabler for exploitation of the other issues in this advisory.

CVE-2026-12168 — Arbitrary Kernel Memory Write

Messages received through the communication port are processed without adequately validating user-supplied memory addresses before they are used as the destination of a write operation. A local attacker can submit a crafted request containing an attacker-controlled destination address and data value, causing the driver to write arbitrary data to kernel memory. This write-what-where primitive can be leveraged to overwrite sensitive OS structures — such as a process's security token — resulting in escalation to SYSTEM privileges.

Note: No proof-of-concept exploit code is published in this advisory. The technical description above is intentionally limited to what is necessary to understand and remediate the issues.

Impact

• CVE-2026-12168 allows a local, unprivileged attacker to obtain SYSTEM privileges and execute code with kernel-level authority.
• CVE-2026-12167 exposes privileged driver functionality to untrusted local users, increasing the accessibility and reliability of exploitation of the other issues.
• CVE-2026-12166 allows any local user to crash the system on demand, resulting in denial of service.

Because GFAC is distributed as part of anti-cheat tooling bundled with multiple games, the affected driver may be present — and loadable — on systems well beyond those actively engaged in gameplay at the time of exploitation.

Recommendations

For defenders / system owners:

• Treat GFAC_Sys_x64.sys as vulnerable pending a vendor fix.
• Where GFAC/anti-cheat functionality is not required, ensure the driver is not present or is prevented from loading.
• Restrict local access to trusted users where GFAC-dependent games must remain installed.
• Monitor for unexpected connections to the GFAC minifilter communication port.

For the vendor:

• Apply a restrictive security descriptor to the minifilter communication port, limiting access to trusted, appropriately privileged callers.
• Validate all user-supplied pointers/addresses before performing writes on their behalf.
• Add NULL/bounds checks to initialization and request-handling code paths.

Disclosure Timeline

References

• NVD: CVE-2026-12166
• NVD: CVE-2026-12167
• NVD: CVE-2026-12168

Credit

Discovered and reported by Lucian Alexandru Necula.