Executive brief
A security vulnerability exists in the MSI NBFoundation Service, a component of MSI Center used to manage hardware settings on MSI laptops and desktops. An attacker with basic access to a computer can exploit this flaw to run programs with the highest possible system privileges (SYSTEM). This could allow a malicious user or malware to take full control of the device, bypass security software, and access all stored data.
Technical details
The MSI NBFoundation Service (MSIAPService.exe) exposes a named pipe (\\.\pipe\MSI_SERVICE_2) with insecure permissions (DACL) that allow all Authenticated Users to communicate with it. While the pipe uses 3DES-ECB encryption, the key is derived deterministically from predictable strings and the current date, making it trivial to bypass. The service fails to validate the 'PC:REXE' (RunExecutable) command group, which uses StartProcessAndBypassUAC to launch arbitrary binaries with a duplicated Winlogon token. A local, low-privileged attacker can exploit this to execute arbitrary code as NT AUTHORITY\SYSTEM. The issue is resolved in MSI Center version 2.0.70.0.
Affected products
- Micro-Star International (MSI) MSI Center (MSI NBFoundation Service) <= 2.0.2506.1201
Timeline
- 2026-02-28: disclosed: Initial disclosure to MSI PSIRT
- 2026-03-09: other: MSI confirms vulnerabilities
- 2026-06-21: patched: Fixed version MSI Center 2.0.70.0 released
- 2026-06-25: advisory: CVE published to NVD