CVE-2026-12168

Name of the Vulnerable Software and Affected Versions Little Orbit GFAC (affected versions not specified)

Description Improper validation and a NULL pointer dereference (a condition where the software attempts to read from a memory address that is null, leading to a crash) in the GFAC Sys x64.sys driver allow a local attacker to cause a denial of service via crafted requests that trigger a system crash. Additionally, an attacker can escalate privileges to SYSTEM and execute arbitrary code in kernel mode by sending crafted messages through a Minifilter communication port.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.