Executive brief
A security vulnerability exists in the MSI NBFoundation Service, a component of MSI Center used to manage hardware settings on MSI computers. An attacker with basic access to the computer can exploit this flaw to read or write directly to the system's physical memory and hardware ports. This could allow an unauthorized user to take full control of the operating system, steal sensitive data, or disable security protections.
Technical details
The MSI NBFoundation Service (MSIAPService.exe), which runs as NT AUTHORITY\SYSTEM, exposes a named pipe (\\.\pipe\MSI_SERVICE_2) with insecure permissions (accessible to all Authenticated Users). The service uses a predictable 3DES-ECB encryption key for communication, allowing any local user to send commands. Specifically, the 'IO' command group acts as an unauthenticated wrapper for the WinIO kernel driver (WinIo64.dll), providing primitives for ReadMemory, WriteMemory, ReadPort, and WritePort. An attacker can leverage these Ring-0 primitives to achieve arbitrary kernel code execution or escalate privileges to SYSTEM. The issue is resolved in MSI Center version 2.0.70.0.
Affected products
- MSI (Micro-Star International) MSI Center (MSI NBFoundation Service) <= 2.0.2506.1201
Timeline
- 2026-02-28: disclosed: Initial disclosure to MSI PSIRT
- 2026-06-21: advisory: Public disclosure by researcher
- 2026-06-25: other: CVE published to NVD