CVE-2026-9492 | The MBStorage DRAM lighting control module within Gigabyte C… | CVSS 7.8 HIGH

Description

The MBStorage DRAM lighting control module within Gigabyte Control Center (GCC) developed by GIGABYTE Technology has an Improper Access Control vulnerability. Authenticated local attackers can send specific IOCTL commands through the driver MyPortIO_x64.sys bundled with the module, thereby arbitrarily reading and writing physical memory and obtaining kernel-level privileges.

Metadata

CVE ID: CVE-2026-9492
State: PUBLISHED
Assigner: twcert
Reserved: 2026-05-25 02:48 UTC
Published: 2026-07-13 03:41 UTC
Last updated: 2026-07-13 03:45 UTC
Primary CWE: CWE-782
CWE-782 Exposed IOCTL with insufficient access control
Vendor / Product: GIGABYTE / MBStorage
Sources: cve.org · NVD

Severity & Metrics

7.8 HIGH CVSS 3.1

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products (1)

Vendor	Product	Platform	Versions
GIGABYTE	MBStorage	—	0 ≤ 26.02.10.01

Weakness (CWE)

CWE	Source	Description
CWE-782	cna	CWE-782 Exposed IOCTL with insufficient access control

CVSS scores (2)

Score	Severity	Version	Source	Vector
8.5	HIGH	4.0	cna	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
7.8	HIGH	3.1	cna	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References (2)