CVE-2026-129255 PUBLISHED

CoolerMaster MASTERPLUS+ Device Driver WinRing0x64.sys sub_11504 default permission

Assigner: VulDB
Reserved: 13.11.2026 Published: 14.11.2026 Updated: 14.11.2026

A vulnerability was identified in CoolerMaster MASTERPLUS+ 1.9.6. This affects the function sub_11504 in the library WinRing0x64.sys of the component Device Driver. The manipulation of the argument PhysicalAddress leads to incorrect default permissions. The attack can only be performed from a local environment. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X
CVSS Score: 9.3

Product Status

Vendor CoolerMaster
Product MASTERPLUS+
Versions
  • Version 1.9.6 is affected

Credits

  • Element2023H (VulDB User) reporter
  • VulDB CNA Team coordinator

References

Problem Types

  • Incorrect Default Permissions CWE
  • Incorrect Privilege Assignment CWE