# CVE-2026-6102: MSI Center privilege escalation in NTIOLib_X64 driver

Source: https://junglewise.ai/threats/cve-2026-6102-msi-center-privilege-escalation-in-ntiolib-x64-driver  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-6102 · Severity: high · CVSS 7.8 · Published 2026-07-29

A security vulnerability in MSI Center, a system management utility for MSI hardware, could allow a user with limited access to gain full administrative control over a computer. By exploiting a flaw in a specific system driver, an attacker can bypass security checks to run commands with the highest possible system permissions. This could lead to a complete compromise of the machine, including the ability to access any data or disable security software.

Technologies: [MSI Center](https://junglewise.ai/threats/technologies/center). Vendors: [MSI](https://junglewise.ai/threats/vendors/msi).

## Quick answers

**Is CVE-2026-6102 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6102 being exploited in the wild.

**How severe is CVE-2026-6102?** High severity, with a CVSS score of 7.8, published 29 July 2026.

**Which products and versions are affected?** MSI Center 2.0.66.0 and versions prior to 2.0.69.0.

**Is there a fix for CVE-2026-6102?** A patch was published on 2026-07-15: Fixed in MSI Center version 2.0.69.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-6102 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-6102?** Check whether you run MSI Center at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An origin validation error (CWE-346) exists within the NTIOLib_X64.sys driver bundled with MSI Center. The driver fails to sufficiently validate the source or origin of commands sent to it, allowing a local process with low privileges to issue requests that the driver executes with kernel-level authority. An attacker who has already gained local code execution can exploit this flaw to escalate their privileges to SYSTEM. The vulnerability was addressed in MSI Center version 2.0.69.0.

## Affected products

- MSI MSI Center 2.0.66.0 and versions prior to 2.0.69.0

## Timeline

- 2026-03-09: other: Vulnerability reported to vendor
- 2026-07-15: patched: Fixed in MSI Center version 2.0.69.0
- 2026-07-15: disclosed: Coordinated public release of advisory
- 2026-07-29: advisory: NVD publication date

## References

- [https://www.zerodayinitiative.com/advisories/ZDI-26-430/](https://www.zerodayinitiative.com/advisories/ZDI-26-430/)

## Related threats

- [MSI NBFoundation Service Privilege Escalation in MSIAPService.exe](https://junglewise.ai/threats/cve-2026-37452-msi-nbfoundation-service-privilege-escalation-in-msiapservice-exe)
- [MSI NBFoundation Service Insecure Registry Permissions](https://junglewise.ai/threats/cve-2026-37454-msi-nbfoundation-service-insecure-registry-permissions)
- [MSI NBFoundation Service insecure permissions in MSI_SERVICE_2 pipe](https://junglewise.ai/threats/cve-2026-37453-msi-nbfoundation-service-insecure-permissions-in-msi-service-2)