CVE-2026-12168

HIGH

Little Orbit GameFirst Anti-Cheat < 2025-07-07 - Arbitrary Code Execution

Title source: rule

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-12168. PoCs published by FzRsLLaSheR.

AI-analyzed exploit summary Technical advisory detailing three local vulnerabilities in Little Orbit GFAC driver (GFAC_Sys_x64.sys), including a NULL pointer dereference (DoS), improper access control on a minifilter communication port, and an arbitrary kernel memory write (LPE to SYSTEM). The writeup provides root cause analysis, affected components, and mitigation recommendations but no exploit code.

Description

An improper validation vulnerability for driver `GFAC_Sys_x64.sys` in Little Orbit GFAC allows a local attacker to escalate privileges to SYSTEM and execute arbitrary code in kernel mode via crafted messages sent through a Minifilter communication port.

Exploits (1)

github WRITEUP

by FzRsLLaSheR · poc

https://github.com/FzRsLLaSheR/CVE-2026-12166_CVE-2026-12167_CVE-2026-12168

View Code ZIP pw:eip

Technical advisory detailing three local vulnerabilities in Little Orbit GFAC driver (GFAC_Sys_x64.sys), including a NULL pointer dereference (DoS), improper access control on a minifilter communication port, and an arbitrary kernel memory write (LPE to SYSTEM). The writeup provides root cause analysis, affected components, and mitigation recommendations but no exploit code.

Classification

Writeup 98%

Attack Type

Lpe

Complexity

Moderate

Reliability

Reliable

Target: Little Orbit GamersFirst Anti-Cheat (GFAC) Driver (GFAC_Sys_x64.sys), SHA-256: b6748d7da5759dee7d5f2f32b0326b4edb7b2135a0e4a6d5ff26aef1e139d8b2

Auth required

Prerequisites: Local access to a system with the vulnerable GFAC driver loaded · Low-privilege user context (non-administrative)

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation T1548 - Abuse Elevation Control Mechanism

mistral-large-3 · analyzed Jul 02, 2026 Full analysis →

References (3)

Core 3

Core References

https://www.littleorbit.com/

https://kb.cert.org/vuls/id/639124

https://github.com/FzRsLLaSheR/CVE-2026-12166_CVE-2026-12167_CVE-2026-12168

Scores

CVSS v3 7.8

EPSS 0.0013

EPSS Percentile 3.0%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

Status published

Products (1)

Little Orbit/GameFirst Anti-Cheat < 2025-07-07

Published Jul 02, 2026

Tracked Since Jul 02, 2026