MSI NBFoundation Service Local Privilege Escalation Vulnerabilities (CVE-2026-37452/3/4) Advisory

Vulnerability Overview The MSI NBFoundation Service within MSI Center contains three local privilege escalation (LPE) and arbitrary operation vulnerabilities. These vulnerabilities allow an attacker to execute arbitrary code with SYSTEM privileges, read/write physical memory and I/O ports, and read/write/delete registry keys. Affected Scope Affected Versions: MSI Center / MSI NBFoundation Service <= 2.0.2506.1201 (MSIAPService.exe) Fixed Version: MSI Center 2.0.70.0 Affected Products: - Vendor: Micro-Star International (MSI) - Product: MSI Center - MSI NBFoundation Service - Component: MSIAPService.exe (Windows service running as NT AUTHORITY\SYSTEM) - Service Name: MSI Foundation Service - Installation Path: C:\Program Files (x86)\MSI\MSI NBFoundation Service\ - Attack Surface: Named pipe \\.\pipe\MSI_SERVICE_2 (Local) Remediation Upgrade MSI Center: Upgrade to version 2.0.70.0 or higher via official MSI update channels. Temporary Measures: Disabling or restricting the service is the only interim mitigation, but it will break MSI Center functionality. POC Code Key Vulnerability Details 1. CVE-2026-37452: Launches arbitrary processes via the PC:REXE command with SYSTEM privileges. 2. CVE-2026-37453: Exposes a named pipe via the WinIO class wrapper, allowing arbitrary physical memory and I/O port read/write operations. 3. CVE-2026-37454: Allows arbitrary read/write/delete operations on HKLM registry keys via the REG command group. Disclosure Timeline 2026-02-28: Initial disclosure to MSI PSIRT. 2026-03-09: MSI confirmed the vulnerabilities and provided an initial fix. 2026-03-20: MSI released updated patches. 2026-06-21: Public disclosure; fixed in MSI Center 2.0.70.0. References MSI Product Security Advisories Disclaimer This repository is intended solely for defensive and educational purposes, coordinated with MSI. The PoCs are minimal reproducers designed to allow administrators to verify if their installations are patched. Do not run PoCs on systems you do not own or have explicit authorization to test.

Goal Reached Thanks to every supporter — we hit 100%!

MSI NBFoundation Service Local Privilege Escalation Vulnerabilities (CVE-2026-37452/3/4) Advisory

More from this source