CVE-2026-82908

CVE-2026-82908 is an integer overflow (CWE-190) in the MmioWritePath function of the NTIOLib_X64.sys kernel driver component (MMIO Write Path Handler) in MSI Dragon Center, exploitable in versions up to and including 2.0.155.0. A local attacker with low privileges can trigger it by manipulating the count/elementSize argument passed to the MMIO write path, causing an integer overflow that corrupts kernel memory. The CVSS 4.0 profile (high confidentiality/integrity/availability across security, system, and safety scopes) indicates an attacker can gain kernel-level control of the affected machine, far beyond the user account they start from. Anyone running an affected Dragon Center version on Windows, typically owners of MSI motherboards, laptops, and other MSI hardware, is affected. The disclosure states an exploit has been made public and could be used, but the flaw is not in CISA KEV, EPSS is very low (0.1% in 30 days, 2nd percentile), and MSI reportedly did not respond to the coordinated disclosure, so no vendor fix is confirmed yet.

What to do: Inventory Windows systems with MSI Dragon Center installed and check whether the version is 2.0.155.0 or earlier and whether the NTIOLib_X64.sys driver is loaded. Because the vendor did not respond to disclosure and no patched release is confirmed in the data, treat an upgrade as 'apply when available' and consider uninstalling Dragon Center or removing the NTIOLib_X64.sys driver on machines that do not need it, while limiting untrusted local accounts on affected systems. Monitor MSI for an updated release and watch for escalation of this flaw given the public exploit.