CVE-2021-27965

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The MsIo64.sys driver before 1.1.19.1016 in MSI Dragon Center before 2.0.98.0 has a buffer overflow that allows privilege escalation via a crafted 0x80102040, 0x80102044, 0x80102050, or 0x80102054 IOCTL request.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/kronl/cve/tree/master/MSI_Dragon_CenterBroken Link, Third Party Advisory
https://www.microsoft.com/en-us/p/msi-dragon-center/9nh7n2bv1cqq?activetab=pivot:overviewtabPatch, Vendor Advisory
https://github.com/kronl/cve/tree/master/MSI_Dragon_CenterBroken Link, Third Party Advisory
https://www.microsoft.com/en-us/p/msi-dragon-center/9nh7n2bv1cqq?activetab=pivot:overviewtabPatch, Vendor Advisory

Timeline

Published: Mar 5, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-279694.8Dolphin CMS 7.4.2 is vulnerable to stored XSS via the Page Builder "width" parameter.CVE-2021-279717.8Alps Alpine Touchpad Driver 10.3201.101.215 is vulnerable to DLL Injection.CVE-2021-279737.2SQL injection exists in Piwigo before 11.4.0 via the language parameter to admin.php?page=languages.CVE-2021-279839.8Remote Code Execution (RCE) vulnerability exists in MaxSite CMS v107.5 via the Documents page.CVE-2021-279848.1In Pluck-4.7.15 admin background a remote command execution vulnerability exists when uploading files.CVE-2021-279895.4Appspace 6.2.4 is vulnerable to stored cross-site scripting (XSS) in multiple parameters within /medianet/sgcontentset.aspx.CVE-2021-279907.5Appspace 6.2.4 is vulnerable to a broken authentication mechanism where pages such as /medianet/mail.aspx can be called directly and the fra CVE-2021-279994.9A SQL injection vulnerability was discovered in the editid parameter in Local Services Search Engine Management System Project 1.0. This vul CVE-2021-280004.8A persistent cross-site scripting vulnerability was discovered in Local Services Search Engine Management System Project 1.0 which allows re CVE-2021-280015.4A cross-site scripting vulnerability was discovered in the Comments parameter in Textpattern CMS 4.8.4 which allows remote attackers to exec CVE-2021-280025.4A persistent cross-site scripting vulnerability was discovered in the Excerpt parameter in Textpattern CMS 4.9.0 which allows remote attacke CVE-2021-280066.1Web Based Quiz System 1.0 is affected by cross-site scripting (XSS) in admin.php through the options parameter.