Local Users Can Write Arbitrary Kernel Memory Through Little Orbit Anti-Cheat Driver CVE-2026-12166 is a NULL pointer dereference that crashes the system with a blue screen. CVE-2026-12167 exposes the driver's minifilter communication port to any local user - no proper access control means even low-privileged accounts can connect and invoke privileged functions. CVE-2026-12168 is the crown jewel for an attacker: a write-what-where condition where the driver writes attacker-supplied data to memory addresses without validation. https://news.ojobit.com/story/little-orbit-gfac-driver-local-privilege-escalation-unpatched-69a1e8
Post summary
The post discloses three new kernel‑level CVEs in the Little Orbit Anti‑Cheat driver, detailing their types and impact, but offers no PoC, exploit code, or patch information.