# CVE-2026-57851: MSI Feature Manager privilege escalation in KernCoreLib64.sys

Source: https://junglewise.ai/threats/cve-2026-57851-msi-feature-manager-privilege-escalation-in-kerncorelib64-sys  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-57851 · Severity: high · CVSS 7.8 · Published 2026-07-07

A security vulnerability exists in a system driver used by MSI Feature Manager software. This flaw allows a standard user who is already logged into the computer to gain full administrative control over the system. An attacker could use this access to steal sensitive data, disable antivirus software, or permanently damage the operating system.

Vendors: [MSI](https://junglewise.ai/threats/vendors/msi).

## Quick answers

**Is CVE-2026-57851 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57851 being exploited in the wild.

**How severe is CVE-2026-57851?** High severity, with a CVSS score of 7.8, published 7 July 2026.

**Which products and versions are affected?** MSI KernCoreLib64.sys All versions included in MSI Feature Manager.

**Is there a fix for CVE-2026-57851?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-57851 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-57851?** Check whether you run MSI Feature Manager or MSI KernCoreLib64.sys at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A local privilege escalation vulnerability exists in the MSI KernCoreLib64.sys kernel driver due to insufficient access control on IOCTL handlers (CWE-782). The driver's device object is accessible to non-privileged users, allowing them to issue IOCTL requests that grant direct physical memory read/write access and unrestricted I/O port operations. An attacker can leverage these capabilities to manipulate kernel objects, tamper with kernel-mode callbacks, bypass Protected Process Light (PPL) protections, and disable security software. This vulnerability requires local access but no user interaction. Proof-of-concept code has been identified in public repositories.

## Affected products

- Micro-Star International (MSI) KernCoreLib64.sys All versions included in MSI Feature Manager

## Timeline

- 2026-07-07: disclosed
- 2026-07-07: advisory

## References

- [https://github.com/readmsr/MSI_FeatureManager_CVE](https://github.com/readmsr/MSI_FeatureManager_CVE)
- [https://www.vulncheck.com/advisories/msi-gamegaraj-kerncorelib64-sys-privilege-escalation-via-ioctl-handlers](https://www.vulncheck.com/advisories/msi-gamegaraj-kerncorelib64-sys-privilege-escalation-via-ioctl-handlers)