Colorful iGameCenter: Local privilege escalation via bundled AMDRyzenMasterDriver.sys
Summary
Colorful iGameCenter 2.0.0.82 contains a flaw in the bundled driver AMDRyzenMasterDriver.sys, in the MmMapIoSpace function of the Dispatch Handler. A local user with low privileges can manipulate the SystemBuffer argument to perform actions reserved for privileged users, which can lead to full system compromise. An attacker must already have code execution on the system, for example through phishing or a malicious download. The vendor did not respond to the early disclosure and no fix or advisory was found.
Affected
- Colorful iGameCenter 2.0.0.82
- Other versions: Unknown.
Fixed in
- Unknown. No vendor fix or advisory found.
Workaround
- No vendor workaround found.
- Uninstall iGameCenter and the bundled driver on systems where it is not needed.
- Check for AMDRyzenMasterDriver.sys on disk; the file name also appears in other tools.
Exploitation
- No public proof of concept known at disclosure (VulDB); recheck.
- Not marked as known exploited; no CISA KEV entry found.
- CISA SSVC: Exploitation poc, Automatable no, Technical Impact total.
- EPSS about 0.0015 (low).
Our recommendation
- Identify systems with iGameCenter 2.0.0.82 installed, prioritising administrator and shared workstations.
- Uninstall iGameCenter and the bundled driver where not required, since no patch exists.
- Enable Microsoft's vulnerable driver blocklist and HVCI (Memory Integrity), and configure EDR to block known vulnerable drivers.
- Restrict local administrator rights and keep endpoint protection current.
- Monitor for the vendor's fix and recheck the NVD status, which could not be confirmed.
- Note: CVSS 9.3 (v4.0) as provided; VulDB lists 8.8 (CVSS 3.1).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulDB CVE-2026-109520 vuldb.com
- VulDB vulnerability 417176 vuldb.com
- VulDB submission 984282 vuldb.com
- Vulners VulnRichment CVE-2026-109520 vulners.com
- HOL Guard CVE-2026-109520 hol.org
- LOLDrivers AMDRyzenMasterDriver.sys www.loldrivers.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:21.
Original description (NVD)
A flaw has been found in Colorful iGameCenter 2.0.0.82. Affected by this vulnerability is the function MmMapIoSpace in the library AMDRyzenMasterDriver.sys of the component Dispatch Handler. This manipulation of the argument SystemBuffer causes privilege defined with unsafe actions. The attack needs to be launched locally. The vendor was contacted early about this disclosure but did not respond in any way.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.