Multiple Local Privilege Escalation Vulnerabilities in Little Orbits GameFirst Anti-Cheat (CVE-2026-12166/12167)

Vulnerability Overview Vulnerability Name: Multiple local privilege escalation vulnerabilities in Little Orbits GameFirst Anti-Cheat Vulnerability ID: VU#639124 Published Date: 2026-07-02 Last Revised Date: 2026-07-02 Scope of Impact Affected Software: Little Orbits GameFirst Anti-Cheat (GFAC) Affected Component: GFAC driver Vulnerability Type: Local Privilege Escalation Specific Vulnerabilities: - CVE-2026-12166: GFAC_Sys_x64.sys contains a NULL pointer dereference condition, which an attacker can trigger, resulting in a system crash (blue screen). - CVE-2026-12167: The minifilter communication port in GFAC_Sys_x64.sys does not enforce sufficiently strict security descriptors, allowing low-privilege users to establish connections with the driver and access functions restricted to trusted processes. Remediation Remediation Recommendations: - Update the GFAC_Sys_x64.sys driver to fix the NULL pointer dereference condition. - Strengthen the security descriptors of the minifilter communication port to restrict access by low-privilege users. POC Code or Exploit Code No POC Code or Exploit Code Available Additional Information Source: Carnegie Mellon University Software Engineering Institute CERT Coordination Center Related Links: - Home - Notes - Search - Report a Vulnerability - Disclosure Guidance - VINCE Summary This vulnerability involves multiple local privilege escalation issues in the Little Orbits GameFirst Anti-Cheat software, primarily affecting the GFAC_Sys_x64.sys driver. Attackers can achieve privilege escalation or cause a system crash by triggering a NULL pointer dereference or abusing the minifilter communication port. It is recommended to update the driver promptly and strengthen security configurations.

Goal Reached Thanks to every supporter — we hit 100%!

Multiple Local Privilege Escalation Vulnerabilities in Little Orbits GameFirst Anti-Cheat (CVE-2026-12166/12167)