CVE-2026-94403
Received Received - Intake

Untrusted Pointer Dereference in ColorFul iGameCenter IOCTL Handler

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: VulDB

Description
A weakness has been identified in ColorFul iGameCenter 1.0.3.4. This impacts the function sub_140001AF0 in the library ene.sys of the component IOCTL Handler. This manipulation causes untrusted pointer dereference. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-22
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-94403
EUVD
EUVD-2026-84052

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
colorful igamecenter 1.0.3.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-822 The product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an untrusted pointer dereference flaw in the ColorFul iGameCenter 1.0.3.4 software. It exists in the function sub_140001AF0 within the ene.sys library, specifically in the IOCTL Handler component. This issue allows an attacker to manipulate memory pointers unsafely, potentially leading to system crashes or arbitrary code execution.

Detection Guidance

Since this vulnerability involves a local untrusted pointer dereference in the ene.sys driver of ColorFul iGameCenter, detection would require checking for the presence of the vulnerable driver and analyzing its behavior. Look for the ene.sys file in system directories and monitor for unusual IOCTL handler interactions. No specific commands are provided in the context.

Impact Analysis

Since the attack can only be executed locally, an attacker would need direct access to your system. Successful exploitation could allow them to execute arbitrary code with elevated privileges, potentially leading to system compromise, data theft, or further malware installation.

Compliance Impact

This vulnerability involves an untrusted pointer dereference in the IOCTL Handler of ene.sys, which could lead to local privilege escalation or arbitrary code execution. Such issues may violate compliance requirements under GDPR (data protection) and HIPAA (health data security) by enabling unauthorized access to sensitive data or system control.

Mitigation Strategies

Immediately uninstall or disable ColorFul iGameCenter 1.0.3.4 to remove the vulnerable ene.sys driver. Block or restrict access to the IOCTL handler functionality. Monitor system logs for suspicious activity related to the driver. Since the vendor did not respond, consider alternative software or patches if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94403. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart