Local Users Can Write Arbitrary Kernel Memory Through Little Orbit Anti-Cheat Driver CVE-2026-12166 is a NULL pointer dereference that crashes the system with a blue screen. CVE-2026-12167 exposes the driver's minifilter communication port to any local user - no proper access control means even low-privileged accounts can connect and invoke privileged functions. CVE-2026-12168 is the crown jewel for an attacker: a write-what-where condition where the driver writes attacker-supplied data to memory addresses without validation. https://news.ojobit.com/story/little-orbit-gfac-driver-local-privilege-escalation-unpatched-69a1e8
Post summary
The article discloses three CVEs affecting the Little Orbit Anti‑Cheat driver, detailing a null pointer crash, lack of access control, and a write‑what‑where flaw that could let local users write arbitrary kernel memory.