{"id":"CVE-2026-129261","kind":"vulnerability","aliases":["CVE-2026-129261"],"related":[],"title":"Kingston FURY CTRL RGB software: local driver flaw exposes unrestricted IOCTL access","description":"A vulnerability was found in Kingston FURY CTRL RGB Control Software up to 2.0.66.0. The impacted element is an unknown function in the library NTIOLib_X64.sys of the component IOCTL Handler. Performing a manipulation results in exposed ioctl with insufficient access control. The attack is only possible with local access.","summary":"Kingston FURY CTRL RGB Control Software up to 2.0.66.0 ships a driver, NTIOLib_X64.sys, whose IOCTL handler is reachable without proper access control (CWE-782), per VulDB. It needs local access. No Kingston advisory, fixed version or public exploit was found.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Kingston FURY CTRL RGB Control Software","fixed":[],"affected":"<= 2.0.66.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["kernel-driver","kingston-fury-ctrl","local-drivers","local-privilege-escalation","other","windows"],"not_affected_if":["newer-version","not-installed","software-not-installed"],"how_to_check":"On Windows, check the installed version of Kingston FURY CTRL RGB Control Software (Settings > Apps); 2.0.66.0 or earlier is in the reported range. Also look for NTIOLib_X64.sys on disk or a loaded driver service (driverquery). Also check if you have the earlier CVE-2026-19381 driver NTIOLib_KSFX.sys (2.0.65.0), a separate issue with a public PoC.","fix":null,"status":"open","published_at":"2026-11-14T16:17:04+00:00","first_seen_at":"2026-11-14T16:30:58+00:00","triaged_at":"2026-11-14T16:31:30+00:00","updated_at":"2026-11-14T16:32:52+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-14T16:31:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Kingston FURY CTRL RGB software: local driver flaw exposes unrestricted IOCTL access","impact":"high","summary":"Kingston FURY CTRL RGB Control Software up to 2.0.66.0 ships a driver, NTIOLib_X64.sys, whose IOCTL handler exposes an interface without proper access control. A local user can send crafted requests to that driver interface.","audience":"everyone","category":"other","nicknames":[],"who_cares":["windows","kingston-fury-ctrl","local-drivers"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"local user gains unrestricted access through the driver interface","analyst_note":"Confirm the fixed version and vendor advisory from Kingston; sources do not state a fix.","how_to_check":"- Check the installed version of Kingston FURY CTRL RGB Control Software against `2.0.66.0`.\n- Look for `NTIOLib_X64.sys` in the driver list of the Windows machine.","plain_action":"If you use Kingston FURY CTRL RGB Control Software, check whether your version is 2.0.66.0 or older and watch Kingston for an updated release.","product_name":"","needs_analyst":true,"not_affected_if":["software-not-installed","newer-version"],"who_is_affected":"Machines with Kingston FURY CTRL RGB Control Software version 2.0.66.0 or older installed, where the NTIOLib_X64.sys driver is loaded. Only someone with local access to the machine can trigger the flaw. Systems without this software can skip it.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000765,"input_tokens":4565,"output_tokens":617,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed version and vendor advisory from Kingston; sources do not state a fix.","search":"'-129261':15A,18A '-2026':14A,17A '-782':64B '2.0.66.0':49B,94C 'access':12A,61B,70B,120C,129C 'advisori':73B 'attack':123C 'compon':108C 'control':23A,45B,62B,90C,121C 'ctrl':3A,21A,31B,43B,88C 'cve':13A,16A 'cwe':63B 'driver':7A,27B,34B,52B 'element':97C 'escal':38B 'exploit':78B 'expos':9A,116C 'fix':74B 'flaw':8A 'found':80B,84C 'function':101C 'furi':2A,30B,42B,87C 'fury':20A 'handler':56B,110C 'impact':96C 'insuffici':119C 'ioctl':11A,55B,109C,117C 'kernel':26B 'kernel-driv':25B 'kingston':1A,19A,29B,41B,72B,86C 'kingston-fury-ctrl':28B 'librari':104C 'local':6A,33B,36B,69B,128C 'local-driv':32B 'local-privilege-escal':35B 'manipul':113C 'need':68B 'ntiolib_x64.sys':53B,105C 'per':65B 'perform':111C 'possibl':126C 'privileg':37B 'proper':60B 'public':77B 'reachabl':58B 'result':114C 'rgb':4A,22A,44B,89C 'ship':50B 'softwar':5A,46B,91C 'software':24A 'unknown':100C 'unrestrict':10A 'version':75B 'vuldb':66B 'vulner':82C 'whose':54B 'window':40B 'without':59B","nicknames":[],"mitigations":[],"who_affected":"Windows PCs with Kingston FURY CTRL RGB Control Software 2.0.66.0 or earlier installed, which ship the NTIOLib_X64.sys driver. VulDB says a local user can reach an IOCTL in that driver without proper access control, so it needs a local foothold, not network access. Machines without the software, such as servers and Macs, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":"If you use Kingston FURY CTRL RGB Control Software, check whether your version is 2.0.66.0 or older and watch Kingston for an updated release.","pkeys":["furyctrlrgbcontrolsoftware","kingstonfuryctrlrgbcontrolsoftware"],"ptokens":["control","ctrl","fury","kingston","rgb","software"],"labels":["critical","kerneldriver","kingstonfuryctrl","localdrivers","localprivilegeescalation","other","windows"],"campaign_type":null,"search_a":"'-129261':15A,18A '-2026':14A,17A 'access':12A 'control':23A 'ctrl':3A,21A 'cve':13A,16A 'driver':7A 'expos':9A 'flaw':8A 'furi':2A 'fury':20A 'ioctl':11A 'kingston':1A,19A 'local':6A 'rgb':4A,22A 'softwar':5A 'software':24A 'unrestrict':10A","search_b":"'-782':64B '2.0.66.0':49B 'access':61B,70B 'advisori':73B 'control':45B,62B 'ctrl':31B,43B 'cwe':63B 'driver':27B,34B,52B 'escal':38B 'exploit':78B 'fix':74B 'found':80B 'furi':30B,42B 'handler':56B 'ioctl':55B 'kernel':26B 'kernel-driv':25B 'kingston':29B,41B,72B 'kingston-fury-ctrl':28B 'local':33B,36B,69B 'local-driv':32B 'local-privilege-escal':35B 'need':68B 'ntiolib_x64.sys':53B 'per':65B 'privileg':37B 'proper':60B 'public':77B 'reachabl':58B 'rgb':44B 'ship':50B 'softwar':46B 'version':75B 'vuldb':66B 'whose':54B 'window':40B 'without':59B","search_c":"'2.0.66.0':94C 'access':120C,129C 'attack':123C 'compon':108C 'control':90C,121C 'ctrl':88C 'element':97C 'expos':116C 'found':84C 'function':101C 'furi':87C 'handler':110C 'impact':96C 'insuffici':119C 'ioctl':109C,117C 'kingston':86C 'librari':104C 'local':128C 'manipul':113C 'ntiolib_x64.sys':105C 'perform':111C 'possibl':126C 'result':114C 'rgb':89C 'softwar':91C 'unknown':100C 'vulner':82C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T16:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129261","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129261","severity":null,"published_at":"2026-11-14T16:17:04+00:00","modified_at":"2026-11-14T16:17:04+00:00","first_seen_at":"2026-11-14T16:30:58+00:00","fetched_at":"2026-11-14T16:30:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-129261:3991","url":"https://vuldb.com/vuln/437302","severity":null,"published_at":"2026-11-14T16:32:52+00:00","modified_at":"2026-11-14T16:32:52+00:00","first_seen_at":"2026-11-14T16:32:52+00:00","fetched_at":"2026-11-14T16:32:52+00:00","note":"Only VulDB (CNA) describes this; no Kingston advisory or fix found. VulDB says no exploit, no countermeasure known, local only, CVSS 8.2. Impact beyond C/I/A not stated, so no SYSTEM claim. Sibling CVE-2026-19381 is a different driver (NTIOLib_KSFX.sys). Nothing verified: no primary source.","cites":["https://vuldb.com/vuln/437302","https://cve.armis.com/CVE-2026-19381"]}],"documents":[{"id":156909,"url":"https://vuldb.com/vuln/437302","title":"VulDB VDB-437302: Kingston FURY CTRL up to 2.0.66.0 NTIOLib_X64.sys exposed IOCTL","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":156910,"url":"https://cve.armis.com/CVE-2026-19381","title":"CVE-2026-19381 (sibling, NTIOLib_KSFX.sys, 2.0.65.0)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}