What is cve-2026-12166_cve-2026-12167_cve-2026-12168?

This repository is not software you run. It is a public security advisory describing three vulnerabilities found in a Windows driver called GFAC_Sys_x64.sys, which is part of the GamersFirst Anti-Cheat system made by Little Orbit and bundled with some games to detect cheating. The researcher found that this driver, which runs with high privilege at the kernel level, accepts messages from ordinary user programs through a communication channel and does not handle that input safely. Three separate problems are documented together here. The first, CVE-2026-12166, is a null pointer error that lets any local user crash the whole system on demand. The second, CVE-2026-12167, is a permissions problem where the communication channel does not properly restrict who can talk to it, so a normal, non-administrator user can reach functionality that should only be available to trusted processes. The third and most serious, CVE-2026-12168, allows an attacker to make the driver write data to an arbitrary location in kernel memory, which can be used to overwrite sensitive system structures and gain full SYSTEM level control of the machine. The advisory explains that these three issues combine into a real path to privilege escalation: the access control weakness makes the write bug reachable by any low privileged local user, and that write bug can then be used to take over the machine entirely. No exploit code is included. The document only explains enough to understand and fix the problems. For people running affected systems, the advisory recommends removing or blocking the driver where anti-cheat is not needed, restricting local access to trusted users where it must stay installed, and watching for unexpected connections to the driver's communication port. For the vendor, it recommends adding proper permission checks to the communication port and validating all memory addresses before writing to them. A disclosure timeline is included showing the vendor was contacted in April 2026 and the case was also submitted to CERT slash CC, but no vendor response was received before this advisory was made public in July 2026.