A flaw in the IOCTL handler of mtdispkm64.sys, part of the Moore Threads MTT S80 Driver Package, allows incorrect privilege handling when the sub_140006F0C routine is invoked. The vulnerability arises from improper verification of caller privileges, enabling a local attacker to gain higher access rights than intended. The weakness maps to CWE-266 (Authorization Bypass Through Privileged Credentials) and CWE-269 (Privilege Escalation via Misconfigured Permissions). When exploited, the attacker can execute actions normally restricted to higher privileged accounts, compromising system integrity and confidentiality.

Moore Threads MTT S80 Driver Package, version 340.150, installed on systems that load the mtdispkm64.sys driver. No other versions are listed as affected.

The CVSS base score of 9.3 classifies this as a Critical vulnerability. The EPSS score is not available, so the exact likelihood of exploitation is unknown, but the local‑only attack requirement indicates that the vulnerability is exploitable by anyone who can log on or otherwise obtain local access to the target machine. Because it is not currently listed in CISA’s KEV catalog, it has not been identified as widely exploited yet, yet the high severity warrants prompt action.