Local Users Can Write Arbitrary Kernel Memory Through Little Orbit Anti-Cheat Driver CVE-2026-12166 is a NULL pointer dereference that crashes the system with a blue screen. CVE-2026-12167 exposes the driver's minifilter communication port to any local user - no proper access control means even low-privileged accounts can connect and invoke privileged functions. CVE-2026-12168 is the crown jewel for an attacker: a write-what-where condition where the driver writes attacker-supplied data to memory addresses without validation. https://news.ojobit.com/story/little-orbit-gfac-driver-local-privilege-escalation-unpatched-69a1e8
Post summary
The article discloses three local privilege escalation vulnerabilities in the Little Orbit anti‑cheat driver, detailing a NULL pointer dereference, minifilter port exposure, and a write‑what‑where flaw that could allow kernel memory writes.