{"id":"CVE-2019-16098","published":"2019-09-11T16:20:16Z","modified":"2024-08-05T01:03:32Z","title":"The driver in Micro-Star MSI Afterburner 4.6.2.15658 (aka RTCore64.sys and RTCore32.sys) allows any authenticated user…","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"The driver in Micro-Star MSI Afterburner 4.6.2.15658 (aka RTCore64.sys and RTCore32.sys) allows any authenticated user to read and write to arbitrary memory, I/O ports, and MSRs. This can be exploited for privilege escalation, code execution under high privileges, and information disclosure. These signed drivers can also be used to bypass the Microsoft driver-signing policy to deploy malicious code.","provenance":"source","from":"CVE.org"},"summary":{"text":"The driver RTCore64.sys and RTCore32.sys shipped with Micro-Star MSI Afterburner 4.6.2.15658 exposes read and write access to arbitrary memory, I/O ports, and MSRs. An attacker who is already an authenticated local user can exploit it to escalate privileges, run code with high privileges, or disclose information, and the signed driver can also be abused to get around Microsoft's driver-signing policy and load malicious code.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:16:32Z"},"cvss":null,"epss":{"score":0.19839,"percentile":0.97405,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2022-10-04","exploitedFirstSeen":"2022-10-04","ransomware":true,"evidence":[{"url":"https://news.sophos.com/en-us/2022/10/04/blackbyte-ransomware-returns/","date":"2022-10-04"},{"url":"https://thehackernews.com/2022/10/blackbyte-ransomware-abuses-vulnerable.html","date":"2022-10-07"},{"url":"https://thehackernews.com/2022/10/oldgremlin-ransomware-targeted-over.html","date":"2022-10-20"},{"url":"https://www.trendmicro.com/en_us/research/22/k/hack-the-real-box-apt41-new-subgroup-earth-longzhi.html","date":"2022-11-09"},{"url":"https://assets.sophos.com/X24WTUEQ/at/b5n9ntjqmbkb8fg5rn25g4fc/sophos-2023-threat-report.pdf","date":"2022-11-16"},{"url":"https://info.securin.io/hubfs/Securin%20Ransomware%20Report%202023.pdf","date":"2023-02-14"},{"url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/","date":"2023-07-06"},{"url":"https://i.blackhat.com/Asia-22/Thursday-Materials/AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf","date":"2023-08-10"},{"url":"https://bi.zone/upload/for_download/Threat_Zone_2025_BI.ZONE_Research_rus.pdf","date":"2025-04-08"}],"evidenceTotal":9,"provenance":"source"},"exploited":true,"otx":{"pulseCount":46,"pulses":[{"name":"UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit","url":"https://otx.alienvault.com/pulse/6a8c073a62ba2c96744372ac","created":"2026-08-24"},{"name":"APT29","url":"https://otx.alienvault.com/pulse/69f46a108000bd36fe90d5be","created":"2026-05-01"},{"name":"Spam “Broken Seal” DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos","url":"https://otx.alienvault.com/pulse/69bf64eccb5d39a90a3c391e","created":"2026-03-22"},{"name":"Spam “Broken Seal” DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos","url":"https://otx.alienvault.com/pulse/69bf64e1d5e06aa6207f78de","created":"2026-03-22"},{"name":"CVE Data","url":"https://otx.alienvault.com/pulse/69929b597293fe5837b9c95c","created":"2026-02-16"},{"name":"“Broken Seal” DocuSign-themed Delivery with Fileless Process Hollowing (Zeppelin/Bloat-A)","url":"https://otx.alienvault.com/pulse/698e93e1ab02db8c49e8c3ed","created":"2026-02-13"},{"name":"The five-day job: A BlackByte ransomware intrusion case study","url":"https://otx.alienvault.com/pulse/64b562868e2e7c00a18e629b","created":"2023-07-17"},{"name":"The five-day job: A BlackByte ransomware intrusion case study | Microsoft Security Blog","url":"https://otx.alienvault.com/pulse/64abeca8f035509f16ba2709","created":"2023-07-10"},{"name":"The five-day job: A BlackByte ransomware intrusion case study | Microsoft Security Blog","url":"https://otx.alienvault.com/pulse/64a75aa85c0fe2192b1469b1","created":"2023-07-07"},{"name":"The five-day job: A BlackByte ransomware intrusion case study | Microsoft Security Blog","url":"https://otx.alienvault.com/pulse/64a75a8a16ae9a1692856ea5","created":"2023-07-07"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://github.com/Barakat/CVE-2019-16098","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[{"id":"SRC-55c3db7cc26d9cd5018b","title":"The five-day job: A BlackByte ransomware intrusion case study","publisher":"microsoft.com","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/","date":"2023-07-06","mentions":[{"quote":"C:SystemDatarENEgOtiAtES (A vulnerable (CVE-2019-16098) driver RtCore64.sys used to evade detection by installed antivirus software; SHA-256: 01aa278b07b58dc46c84bd0b1b5c8e9ee4e62ea0bf7a695862444af32e87f1fd)","start":10571,"end":10778},{"quote":"CVE-2019-16098","start":19229,"end":19243}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2019-6943","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-6943","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":5,"skipped":0,"earliest":"2019-09-10","earliestUrl":"https://github.com/Barakat/CVE-2019-16098","repos":[{"name":"Barakat/CVE-2019-16098","url":"https://github.com/Barakat/CVE-2019-16098","stars":200,"created":"2019-09-10"},{"name":"Offensive-Panda/NT-AUTHORITY-SYSTEM-CONTEXT-RTCORE","url":"https://github.com/Offensive-Panda/NT-AUTHORITY-SYSTEM-CONTEXT-RTCORE","stars":34,"created":"2024-08-05"},{"name":"0xDivyanshu-new/CVE-2019-16098","url":"https://github.com/0xDivyanshu-new/CVE-2019-16098","stars":6,"created":"2023-09-01"},{"name":"VortexCry-Organization/VortexCry-Ransomware-Release","url":"https://github.com/VortexCry-Organization/VortexCry-Ransomware-Release","stars":1,"created":"2026-01-22"},{"name":"CrowTheArchfiend/RTCore64-probe","url":"https://github.com/CrowTheArchfiend/RTCore64-probe","stars":0,"created":"2026-03-04"}]},"first":{"date":"2019-09-10","source":"PoC-in-GitHub","url":"https://github.com/Barakat/CVE-2019-16098"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2019-09-10","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/Barakat/CVE-2019-16098","provenance":"source"},{"date":"2019-09-11","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2019-16098","provenance":"source"},{"date":"2022-10-04","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://news.sophos.com/en-us/2022/10/04/blackbyte-ransomware-returns/","provenance":"source"},{"date":"2023-07-06","kind":"report","label":"Named in microsoft.com: The five-day job: A BlackByte ransomware intrusion case study","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/","provenance":"machine"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":76.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1486 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.48,"detail":"percentile 0.9740"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"5 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"46 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}