CVE-2026-109520: Escalation in iGameCenter, Risk for AMD

Local escalation in iGameCenter 2.0.0.82, CVSS 8.8: risk for AMD administrators.

CVE-2026-109520 is a local privilege escalation in Colorful iGameCenter version 2.0.0.82 that compromises the AMDRyzenMasterDriver.sys system driver. The flaw resides in the MmMapIoSpace function, where unsafe handling of the SystemBuffer argument allows a local user to elevate privileges to kernel level. The vector is local, requiring system access, but the impact is critical: full administrative system control.

The official CVSS is 8.8, classified as high. The CVE was published on NVD on 2026-10-13. The disclosure status is grave: the Colorful vendor was contacted during early disclosure but provided no response and no official patch is known. As of today (2026-10-31), a GitHub signal indicates that public repositories declare containing exploit code. This context indicates an actively exploitable vulnerability without vendor mitigation.

Defensive actions must include: continuous monitoring of vendor advisories for future communications; on AMD systems with iGameCenter, strictly limit local access to trusted users; evaluate complete uninstallation or isolation of iGameCenter until patch availability; audit running processes and loaded drivers to detect anomalous behavior; implement kernel-level auditing and logging.

Administrators of AMD consumer or workstation systems with iGameCenter installed must prioritize this vulnerability: a local privilege escalation with CVSS 8.8 allows local malware or attackers to gain full kernel control. The vendor's failure to respond raises grave concerns about fix timeliness and availability.

At a glance

What: CVE-2026-109520 is a local privilege escalation in Colorful iGameCenter version 2.0.0.82. The vulnerability resides in the MmMapIoSpace function of the AMDRyzenMasterDriver.sys driver (Dispatch Handler component), where unsafe manipulation of the SystemBuffer argument allows a local user to elevate privileges to kernel level.
Severity: CVSS 8.8 (high). A local privilege escalation at this score significantly compromises system confidentiality and integrity, enabling full administrative access via kernel exploit.
Affected versions: Colorful iGameCenter 2.0.0.82. No other versions specified in official data; verify if previous or later versions are deployed.
Fix: Not reported. Vendor was contacted during early disclosure on 2026-10-13 but has provided no official response or patch to date.
Status: Vulnerability published on NVD on 2026-10-13. GitHub signal positive as of 2026-10-31 indicating public repositories declare containing exploit code. Vendor remains unresponsive.
Action: Monitor vendor advisories and security sources. On systems with iGameCenter: restrict local access to trusted users, evaluate uninstallation, audit loaded drivers and kernel processes. Implement kernel auditing and logging. Isolate from untrusted networks until patch available.

Sources: NVD, CVE-2026-109520

← All articles