Local Environment Privilege Escalation in CoolerMaster MASTERPLUS+ Device Driver
CVE-2026-129255

9.3CRITICAL

Key Information:

Vendor

Coolermaster

Status
Masterplus+
Vendor
CVE Published:
14 November 2026

What is CVE-2026-129255?

A local privilege escalation vulnerability exists within the CoolerMaster MASTERPLUS+ device driver version 1.9.6, specifically in the function sub_11504 of the WinRing0x64.sys library. This flaw allows manipulation of the PhysicalAddress argument, which results in incorrect default permissions. An attacker operating within the local environment could potentially exploit this vulnerability, leading to unauthorized access and modification of system settings. Despite early disclosure attempts, the vendor has not provided a response regarding this security issue.

Affected Version(s)

MASTERPLUS+ 1.9.6

References

https://vuldb.com/vuln/437286
vdb-entrytechnical-description
https://vuldb.com/vuln/437286/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-129255
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Element2023H (VulDB User)
VulDB CNA Team
.