Description
A vulnerability was found in Colorful iGameCenter 2.0.0.81. This vulnerability affects the function sub_11504 in the library WinRing0x64.sys of the component IOCTL Dispatch. Performing a manipulation of the argument PhysicalAddress/AlignNumer/AlignSize results in improper privilege management. Attacking locally is a requirement.
Published: 2026-08-31
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Local Privilege Escalation
Action: Apply Vendor Patch
AI Analysis

Impact

The flaw resides in the sub_11504 routine of the WinRing0x64.sys driver that handles IOCTL requests for physical memory access. By supplying specially crafted PhysicalAddress, AlignNumer, and AlignSize parameters, an attacker with local privileges can circumvent intended checks and gain elevated rights to read or write physical memory. This constitutes a privilege escalation defect consistent with CWE-266 and CWE-269, potentially enabling arbitrary code execution or data exfiltration within the host.

Affected Systems

Colorful iGameCenter version 2.0.0.81 on Windows systems is the documented vulnerable build. Users running this specific version are susceptible; no other products or releases are currently known to be affected.

Risk and Exploitability

The CVSS score of 9.3 marks this issue as critical. Because exploitation requires local access, remote attackers are not affected. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. If an attacker can authenticate locally or can execute code with user-level rights, they can leverage the privilege mismanagement to elevate privileges and potentially compromise the entire machine.

Generated by OpenCVE AI on August 31, 2026 at 08:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Restrict local user accounts to the principle of least privilege, ensuring administrators are only used when truly required for iGameCenter operation.
  • Disable or limit any features in iGameCenter that expose physical memory access, thereby reducing the attack surface for the WinRing0x64.sys driver.
  • Monitor Windows event logs for irregular IOCTL calls to WinRing0x64.sys and investigate repeated or malformed requests that may indicate exploitation attempts.
  • Check the vendor’s website regularly for an update or patch addressing the privilege handling flaw.

Generated by OpenCVE AI on August 31, 2026 at 08:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 31 Aug 2026 07:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in Colorful iGameCenter 2.0.0.81. This vulnerability affects the function sub_11504 in the library WinRing0x64.sys of the component IOCTL Dispatch. Performing a manipulation of the argument PhysicalAddress/AlignNumer/AlignSize results in improper privilege management. Attacking locally is a requirement.
Title Colorful iGameCenter IOCTL Dispatch WinRing0x64.sys sub_11504 privileges management
First Time appeared Colorful
Colorful igamecenter
Weaknesses CWE-266
CWE-269
CPEs cpe:2.3:a:colorful:igamecenter:*:*:*:*:*:*:*:*
Vendors & Products Colorful
Colorful igamecenter
References
Metrics cvssV2_0

{'score': 6.8, 'vector': 'AV:L/AC:L/Au:S/C:C/I:C/A:C/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X'}

Subscriptions

Colorful Igamecenter
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-31T14:34:57.895Z

Reserved: 2026-08-30T09:59:30.384Z

Link: CVE-2026-82628

cve-icon Vulnrichment

Updated: 2026-08-31T14:34:53.060Z

cve-icon NVD

Status : Deferred

Published: 2026-08-31T07:17:47.307

Modified: 2026-08-31T20:56:08.800

Link: CVE-2026-82628

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T11:18:53Z

Weaknesses
  • CWE-266

    Incorrect Privilege Assignment

  • CWE-269

    Improper Privilege Management