Executive brief
Little Orbit GamersFirst Anti-Cheat (GFAC) is a security tool bundled with various video games to prevent cheating. A vulnerability in its core driver allows a standard user on a computer to gain full administrative (SYSTEM) control over the operating system. This could allow an attacker to bypass security protections, access sensitive data, or install persistent malware.
Technical details
An arbitrary kernel memory write ("write-what-where") vulnerability exists in the Little Orbit GFAC_Sys_x64.sys driver. The driver processes messages received through a Minifilter communication port without adequately validating user-supplied memory addresses before using them as the destination for write operations. A local, unprivileged attacker can send a crafted request to the communication port to overwrite sensitive kernel structures, such as process security tokens, to escalate privileges to SYSTEM. This is often facilitated by CVE-2026-12167, which identifies improper access control on the same communication port. As of the advisory date, the vendor has not responded to disclosure attempts, and no patch is available.
Affected products
- Little Orbit GamersFirst Anti-Cheat (GFAC) Versions up to and including 2025-07-07
Timeline
- 2026-04-01: other: Vendor contacted by researcher
- 2026-04-20: other: Case submitted to CERT/CC
- 2026-07-02: disclosed: Public advisory published by researcher and CERT/CC