CVE-2026-12166

A NULL pointer dereference vulnerability for driver `GFAC_Sys_x64.sys` in Little Orbit GFAC allows a local attacker to cause a denial of service via crafted requests that trigger a system crash.

Affected products

Little Orbit Gfac

CVSS 3.1

5.5 MEDIUM

EPSS

0.2% (7th percentile)

NVD status

Deferred

Published

2026-07-02