# CVE-2026-37454: MSI NBFoundation Service Insecure Registry Permissions

Source: https://junglewise.ai/threats/cve-2026-37454-msi-nbfoundation-service-insecure-registry-permissions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-37454 · Severity: info · CVSS 7.8 · Published 2026-06-25

A vulnerability in the MSI NBFoundation Service, a component of MSI Center used for system management on MSI laptops and desktops, allows a local user to gain unauthorized control over the computer. By exploiting insecure communication settings, an attacker can read, modify, or delete critical system registry keys. This could lead to permanent system access, the ability to disable security software, or the corruption of the operating system.

Technologies: [MSI Center](https://junglewise.ai/threats/technologies/center). Vendors: [MSI](https://junglewise.ai/threats/vendors/msi).

## Quick answers

**Is CVE-2026-37454 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-37454 being exploited in the wild.

**How severe is CVE-2026-37454?** Informational severity, with a CVSS score of 7.8, published 25 June 2026.

**Which products and versions are affected?** MSI Center <= 2.0.2506.1201.

**Is there a fix for CVE-2026-37454?** A patch was published on 2026-06-21: Fixed in MSI Center 2.0.70.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-37454 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-37454?** Check whether you run MSI Center at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The MSI NBFoundation Service (MSIAPService.exe), which runs as NT AUTHORITY\SYSTEM, exposes a named pipe (\\.\pipe\MSI_SERVICE_2) with a DACL that grants access to all 'Authenticated Users'. While the pipe uses 3DES-ECB encryption, the key is derived from predictable strings and the current date, allowing any local user to bypass this protection. The service's 'REG' command group (including RREQ, WREQ, and DREQ) lacks caller authentication, permitting an unprivileged local attacker to read, write, or delete arbitrary registry keys in the HKLM and HKCU hives. This can be leveraged for persistence or service hijacking. The issue is resolved in MSI Center version 2.0.70.0.

## Affected products

- Micro-Star International (MSI) MSI Center (MSI NBFoundation Service) <= 2.0.2506.1201

## Timeline

- 2026-02-28: disclosed: Initial disclosure to MSI PSIRT
- 2026-06-21: patched: Fixed in MSI Center 2.0.70.0
- 2026-06-25: advisory: NVD publication date

## References

- [https://csr.msi.com/global/product-security-advisories](https://csr.msi.com/global/product-security-advisories)
- [https://github.com/LittleSuRii/CVE-2026-MSIAPService](https://github.com/LittleSuRii/CVE-2026-MSIAPService)

## Related threats

- [MSI Center privilege escalation in NTIOLib_X64 driver](https://junglewise.ai/threats/cve-2026-6102-msi-center-privilege-escalation-in-ntiolib-x64-driver)
- [MSI NBFoundation Service Privilege Escalation in MSIAPService.exe](https://junglewise.ai/threats/cve-2026-37452-msi-nbfoundation-service-privilege-escalation-in-msiapservice-exe)
- [MSI NBFoundation Service insecure permissions in MSI_SERVICE_2 pipe](https://junglewise.ai/threats/cve-2026-37453-msi-nbfoundation-service-insecure-permissions-in-msi-service-2)