# CVE-2026-37452: MSI NBFoundation Service Privilege Escalation in MSIAPService.exe

Source: https://junglewise.ai/threats/cve-2026-37452-msi-nbfoundation-service-privilege-escalation-in-msiapservice-exe  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-37452 · Severity: info · CVSS 7.8 · Published 2026-06-25

A security vulnerability exists in the MSI NBFoundation Service, a component of MSI Center used to manage hardware settings on MSI laptops and desktops. An attacker with basic access to a computer can exploit this flaw to run programs with the highest possible system privileges (SYSTEM). This could allow a malicious user or malware to take full control of the device, bypass security software, and access all stored data.

Technologies: [MSI Center](https://junglewise.ai/threats/technologies/center). Vendors: [MSI](https://junglewise.ai/threats/vendors/msi).

## Quick answers

**Is CVE-2026-37452 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-37452 being exploited in the wild.

**How severe is CVE-2026-37452?** Informational severity, with a CVSS score of 7.8, published 25 June 2026.

**Which products and versions are affected?** MSI Center <= 2.0.2506.1201.

**Is there a fix for CVE-2026-37452?** A patch was published on 2026-06-21: Fixed version MSI Center 2.0.70.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-37452 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-37452?** Check whether you run MSI Center at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The MSI NBFoundation Service (MSIAPService.exe) exposes a named pipe (\\.\pipe\MSI_SERVICE_2) with insecure permissions (DACL) that allow all Authenticated Users to communicate with it. While the pipe uses 3DES-ECB encryption, the key is derived deterministically from predictable strings and the current date, making it trivial to bypass. The service fails to validate the 'PC:REXE' (RunExecutable) command group, which uses StartProcessAndBypassUAC to launch arbitrary binaries with a duplicated Winlogon token. A local, low-privileged attacker can exploit this to execute arbitrary code as NT AUTHORITY\SYSTEM. The issue is resolved in MSI Center version 2.0.70.0.

## Affected products

- Micro-Star International (MSI) MSI Center (MSI NBFoundation Service) <= 2.0.2506.1201

## Timeline

- 2026-02-28: disclosed: Initial disclosure to MSI PSIRT
- 2026-03-09: other: MSI confirms vulnerabilities
- 2026-06-21: patched: Fixed version MSI Center 2.0.70.0 released
- 2026-06-25: advisory: CVE published to NVD

## References

- [https://csr.msi.com/global/product-security-advisories](https://csr.msi.com/global/product-security-advisories)
- [https://github.com/LittleSuRii/CVE-2026-MSIAPService](https://github.com/LittleSuRii/CVE-2026-MSIAPService)

## Related threats

- [MSI Center privilege escalation in NTIOLib_X64 driver](https://junglewise.ai/threats/cve-2026-6102-msi-center-privilege-escalation-in-ntiolib-x64-driver)
- [MSI NBFoundation Service Insecure Registry Permissions](https://junglewise.ai/threats/cve-2026-37454-msi-nbfoundation-service-insecure-registry-permissions)
- [MSI NBFoundation Service insecure permissions in MSI_SERVICE_2 pipe](https://junglewise.ai/threats/cve-2026-37453-msi-nbfoundation-service-insecure-permissions-in-msi-service-2)