Skip to content
OpenAdvisories
Unscored Public exploit CVE-2019-16098 EUVD-2019-6943GHSA-pgj3-5w38-pg9m

The driver in Micro-Star MSI Afterburner 4.6.2.15658 (aka RTCore64.sys and RTCore32.sys) allows any authenticated user to read and write to…

Published Sep 11, 2019 · Updated Aug 5, 2024 · Assigned by mitre

Description

The driver in Micro-Star MSI Afterburner 4.6.2.15658 (aka RTCore64.sys and RTCore32.sys) allows any authenticated user to read and write to arbitrary memory, I/O ports, and MSRs. This can be exploited for privilege escalation, code execution under high privileges, and information disclosure. These signed drivers can also be used to bypass the Microsoft driver-signing policy to deploy malicious code.

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 5 repositories

  • Barakat/CVE-2019-16098 ★ 200 · Sep 10, 2019

    Local privilege escalation PoC exploit for CVE-2019-16098

  • Offensive-Panda/NT-AUTHORITY-SYSTEM-CONTEXT-RTCORE ★ 34 · Aug 5, 2024

    This exploit rebuilds and exploit the CVE-2019-16098 which is in driver Micro-Star MSI Afterburner 4.6.2.15658 (aka RTCore64.sys and RTCore32.sys) allows any authenticated user to read and write to a…

  • 0xDivyanshu-new/CVE-2019-16098 ★ 6 · Sep 1, 2023
  • VortexCry-Organization/VortexCry-Ransomware-Release ★ 1 · Jan 22, 2026

    # VortexCry-Ransomware VortexCry is an advanced ransomware that utilizes multi-stage process injection (such as Process Hollowing and APC Injection) and kernel driver loading (via the CVE-2019-16098 …

  • CrowTheArchfiend/RTCore64-probe ★ 0 · Mar 4, 2026

    A tiny cpp program to test reading memory using a vulnerable RTCore64.sys driver/device (CVE-2019-16098). It tries to read a "secret" from its own memory using the driver, to test if the handle has b…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References