{"id":"CVE-2019-16098","aliases":["EUVD-2019-6943","GHSA-pgj3-5w38-pg9m"],"status":"published","title":"The driver in Micro-Star MSI Afterburner 4.6.2.15658 (aka RTCore64.sys and RTCore32.sys) allows...","description":"The driver in Micro-Star MSI Afterburner 4.6.2.15658 (aka RTCore64.sys and RTCore32.sys) allows any authenticated user to read and write to arbitrary memory, I/O ports, and MSRs. This can be exploited for privilege escalation, code execution under high privileges, and information disclosure. These signed drivers can also be used to bypass the Microsoft driver-signing policy to deploy malicious code.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.19839,"percentile":0.97434,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-125","CWE-269","CWE-787"],"published":"2019-09-11T16:20:16Z","modified":"2026-06-17T02:21:39Z","exploits":[{"source":"pocgithub","id":"0xDivyanshu-new/CVE-2019-16098","title":"0xDivyanshu-new/CVE-2019-16098","date":"2023-09-01","url":"https://github.com/0xDivyanshu-new/CVE-2019-16098"},{"source":"pocgithub","id":"Barakat/CVE-2019-16098","title":"Barakat/CVE-2019-16098","date":"2019-09-10","url":"https://github.com/Barakat/CVE-2019-16098"},{"source":"pocgithub","id":"CrowTheArchfiend/RTCore64-probe","title":"CrowTheArchfiend/RTCore64-probe","date":"2026-03-04","url":"https://github.com/CrowTheArchfiend/RTCore64-probe"},{"source":"pocgithub","id":"Offensive-Panda/NT-AUTHORITY-SYSTEM-CONTEXT-RTCORE","title":"Offensive-Panda/NT-AUTHORITY-SYSTEM-CONTEXT-RTCORE","date":"2024-08-05","url":"https://github.com/Offensive-Panda/NT-AUTHORITY-SYSTEM-CONTEXT-RTCORE"},{"source":"pocgithub","id":"VortexCry-Organization/VortexCry-Ransomware-Release","title":"VortexCry-Organization/VortexCry-Ransomware-Release","date":"2026-01-22","url":"https://github.com/VortexCry-Organization/VortexCry-Ransomware-Release"}],"products":[{"vendor":"msi","product":"afterburner"}],"references":[{"url":"https://github.com/Barakat/CVE-2019-16098","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16098"},{"url":"https://github.com/advisories/GHSA-pgj3-5w38-pg9m"}],"sources":{"cve":[{"id":"CVE-2019-16098","description":"The driver in Micro-Star MSI Afterburner 4.6.2.15658 (aka RTCore64.sys and RTCore32.sys) allows any authenticated user to read and write to arbitrary memory, I/O ports, and MSRs. This can be exploited for privilege escalation, code execution under high privileges, and information disclosure. These signed drivers can also be used to bypass the Microsoft driver-signing policy to deploy malicious code.","status":"published","published":"2019-09-11T16:20:16Z","modified":"2024-08-05T01:03:32.893Z","updated_at":"2026-11-02T14:32:23.485011Z"}],"euvd":[{"id":"EUVD-2019-6943","description":"The driver in Micro-Star MSI Afterburner 4.6.2.15658 (aka RTCore64.sys and RTCore32.sys) allows any authenticated user to read and write to arbitrary memory, I/O ports, and MSRs. This can be exploited for privilege escalation, code execution under high privileges, and information disclosure. These signed drivers can also be used to bypass the Microsoft driver-signing policy to deploy malicious code.","status":"published","published":"2019-09-11T16:20:16Z","modified":"2024-08-05T01:03:32Z","updated_at":"2026-11-03T02:40:34.136734Z"}],"ghsa":[{"id":"GHSA-pgj3-5w38-pg9m","title":"The driver in Micro-Star MSI Afterburner 4.6.2.15658 (aka RTCore64.sys and RTCore32.sys) allows...","description":"The driver in Micro-Star MSI Afterburner 4.6.2.15658 (aka RTCore64.sys and RTCore32.sys) allows any authenticated user to read and write to arbitrary memory, I/O ports, and MSRs. This can be exploited for privilege escalation, code execution under high privileges, and information disclosure. These signed drivers can also be used to bypass the Microsoft driver-signing policy to deploy malicious code.","status":"published","published":"2022-05-24T16:55:55Z","modified":"2024-04-04T01:55:13Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-125","CWE-269"],"updated_at":"2026-11-02T14:56:03.89673Z"}],"nvd":[{"id":"CVE-2019-16098","description":"The driver in Micro-Star MSI Afterburner 4.6.2.15658 (aka RTCore64.sys and RTCore32.sys) allows any authenticated user to read and write to arbitrary memory, I/O ports, and MSRs. This can be exploited for privilege escalation, code execution under high privileges, and information disclosure. These signed drivers can also be used to bypass the Microsoft driver-signing policy to deploy malicious code.","status":"published","published":"2019-09-11T17:15:10.713Z","modified":"2026-06-17T02:21:39.84Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-125","CWE-787"],"updated_at":"2026-11-02T14:05:25.691233Z"}]}}