{"id":"CVE-2026-129255","kind":"vulnerability","aliases":["CVE-2026-129255"],"related":[],"title":"CoolerMaster MASTERPLUS+ 1.9.6: driver flaw grants local users elevated access","description":"A vulnerability was identified in CoolerMaster MASTERPLUS+ 1.9.6. This affects the function sub_11504 in the library WinRing0x64.sys of the component Device Driver. The manipulation of the argument PhysicalAddress leads to incorrect default permissions. The attack can only be performed from a local environment. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"A device driver (WinRing0x64.sys) bundled with CoolerMaster MASTERPLUS+ 1.9.6 sets incorrect default permissions when handling a PhysicalAddress argument. A local user can use this to reach hardware-level memory access that should be restricted.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"CoolerMaster MASTERPLUS+","fixed":[],"affected":"1.9.6","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["byovd","coolermaster","driver","local-privilege-escalation","masterplus","other","windows"],"not_affected_if":["no-local-access","product-not-installed"],"how_to_check":"- Look for WinRing0x64.sys in the MASTERPLUS+ install folder and in loaded drivers (sc query WinRing0_1_2_0, or fltmc/driverquery).\n- Check the installed MASTERPLUS+ version is 1.9.6.\n- Also check if you run other tools that bundle WinRing0 (Defender flags it as VulnerableDriver:WinNT/Winring0); that is a separate known issue, not confirmed for this CVE.","fix":"unknown: no fixed version published. The vendor did not respond to disclosure. Uninstall MASTERPLUS+ or remove the driver until Cooler Master ships a fix.","status":"open","published_at":"2026-11-14T13:17:21+00:00","first_seen_at":"2026-11-14T13:28:09+00:00","triaged_at":"2026-11-14T13:28:59+00:00","updated_at":"2026-11-14T13:30:27+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-14T13:28:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"CoolerMaster MASTERPLUS+ 1.9.6: driver flaw grants local users elevated access","impact":"high","summary":"A device driver (WinRing0x64.sys) bundled with CoolerMaster MASTERPLUS+ 1.9.6 sets incorrect default permissions when handling a PhysicalAddress argument. A local user can use this to reach hardware-level memory access that should be restricted.","audience":"everyone","category":"other","nicknames":[],"who_cares":["windows","coolermaster","masterplus"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains privileged hardware memory access on Windows","analyst_note":"Confirm the affected versions, whether a fix exists, and the privilege level gained; the vendor did not respond to disclosure.","how_to_check":"- Look for `WinRing0x64.sys` on Windows machines with CoolerMaster MASTERPLUS+ installed\n- Check the installed MASTERPLUS+ version is `1.9.6`\n- unknown for other checks: the sources do not say","plain_action":"If you use CoolerMaster MASTERPLUS+ 1.9.6 on a Windows PC, uninstall it or wait for a fix from CoolerMaster, since the vendor has not responded to the disclosure.","product_name":"CoolerMaster MASTERPLUS+","needs_analyst":true,"not_affected_if":["no-local-access","product-not-installed"],"who_is_affected":"Machines running CoolerMaster MASTERPLUS+ 1.9.6 on Windows, where the bundled WinRing0x64.sys driver is installed. Only local users can exploit it, so systems without local untrusted accounts face lower risk. unknown whether other versions are affected.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000803,"input_tokens":4583,"output_tokens":690,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the affected versions, whether a fix exists, and the privilege level gained; the vendor did not respond to disclosure.","search":"'-129255':13A,16A '-2026':12A,15A '1.9.6':3A,37B,71C '11504':77C 'access':10A,59B 'affect':73C 'argument':46B,91C 'attack':99C 'bundl':33B 'byovd':19B 'compon':84C 'contact':111C 'coolermast':1A,20B,35B,69C 'coolermaster':17A 'cve':11A,14A 'default':40B,96C 'devic':30B,85C 'disclosur':115C 'driver':4A,21B,31B,86C 'earli':112C 'elev':9A 'environ':107C 'escal':25B 'flaw':5A 'function':75C 'grant':6A 'handl':43B 'hardwar':56B 'hardware-level':55B 'identifi':67C 'incorrect':39B,95C 'lead':93C 'level':57B 'librari':80C 'local':7A,23B,48B,106C 'local-privilege-escal':22B 'manipul':88C 'masterplus':2A,18A,26B,36B,70C 'memori':58B 'perform':103C 'permiss':41B,97C 'physicaladdress':45B,92C 'privileg':24B 'reach':54B 'respond':119C 'restrict':63B 'set':38B 'sub':76C 'use':51B 'user':8A,49B 'vendor':109C 'vulner':65C 'way':122C 'window':28B 'winring0x64.sys':32B,81C","nicknames":[],"mitigations":[],"who_affected":"Windows PCs running CoolerMaster MASTERPLUS+ 1.9.6 with its bundled WinRing0x64.sys driver. A local user with a low-privilege account can abuse the driver's PhysicalAddress handling, so shared or multi-user machines and machines where malware could run as a normal user matter most. Single-user machines without MASTERPLUS+ can skip it. Other MASTERPLUS+ versions are not confirmed either way.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you use CoolerMaster MASTERPLUS+ 1.9.6 on a Windows PC, uninstall it or wait for a fix from CoolerMaster, since the vendor has not responded to the disclosure.","pkeys":["coolermastermasterplus","masterplus"],"ptokens":["coolermaster","masterplus"],"labels":["byovd","coolermaster","critical","driver","localprivilegeescalation","masterplus","other","vendor","windows"],"campaign_type":null,"search_a":"'-129255':13A,16A '-2026':12A,15A '1.9.6':3A 'access':10A 'coolermast':1A 'coolermaster':17A 'cve':11A,14A 'driver':4A 'elev':9A 'flaw':5A 'grant':6A 'local':7A 'masterplus':2A,18A 'user':8A","search_b":"'1.9.6':37B 'access':59B 'argument':46B 'bundl':33B 'byovd':19B 'coolermast':20B,35B 'default':40B 'devic':30B 'driver':21B,31B 'escal':25B 'handl':43B 'hardwar':56B 'hardware-level':55B 'incorrect':39B 'level':57B 'local':23B,48B 'local-privilege-escal':22B 'masterplus':26B,36B 'memori':58B 'permiss':41B 'physicaladdress':45B 'privileg':24B 'reach':54B 'restrict':63B 'set':38B 'use':51B 'user':49B 'window':28B 'winring0x64.sys':32B","search_c":"'1.9.6':71C '11504':77C 'affect':73C 'argument':91C 'attack':99C 'compon':84C 'contact':111C 'coolermast':69C 'default':96C 'devic':85C 'disclosur':115C 'driver':86C 'earli':112C 'environ':107C 'function':75C 'identifi':67C 'incorrect':95C 'lead':93C 'librari':80C 'local':106C 'manipul':88C 'masterplus':70C 'perform':103C 'permiss':97C 'physicaladdress':92C 'respond':119C 'sub':76C 'vendor':109C 'vulner':65C 'way':122C 'winring0x64.sys':81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T13:17:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129255","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129255","severity":null,"published_at":"2026-11-14T13:17:21+00:00","modified_at":"2026-11-14T13:17:22+00:00","first_seen_at":"2026-11-14T13:28:09+00:00","fetched_at":"2026-11-14T13:28:09+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-129255:3981","url":"https://vuldb.com/cve/CVE-2026-129255","severity":null,"published_at":"2026-11-14T13:30:27+00:00","modified_at":"2026-11-14T13:30:27+00:00","first_seen_at":"2026-11-14T13:30:27+00:00","fetched_at":"2026-11-14T13:30:27+00:00","note":"No vendor advisory found; VulDB/CNA text says vendor never responded. Cooler Master's MasterPlus page lists 1.9.6 as the current release, with no security note. Privilege gained is not stated; CVSS is local, low privileges, high impact. WinRing0 is a known vulnerable driver family (CVE-2020-14979, Microsoft Defender detection). Nothing verified.","cites":["https://vuldb.com/cve/CVE-2026-129255","https://www.coolermaster.com/en-global/masterplus.html","https://support.microsoft.com/en-us/windows/security/threat-malware-protection/microsoft-defender-antivirus-alert-vulnerabledriver-winnt-winring0"]}],"documents":[{"id":155854,"url":"https://vuldb.com/cve/CVE-2026-129255","title":"VulDB CVE-2026-129255 MASTERPLUS+","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":155855,"url":"https://www.coolermaster.com/en-global/masterplus.html","title":"MasterPlus release notes (Cooler Master)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":155856,"url":"https://support.microsoft.com/en-us/windows/security/threat-malware-protection/microsoft-defender-antivirus-alert-vulnerabledriver-winnt-winring0","title":"Microsoft: VulnerableDriver:WinNT/Winring0","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}