Your RGB lighting installed a kernel driver — and a Windows update is how you found out

Microsoft shipped KB5121003 on 11 August 2026 for Windows 11 24H2 and 25H2. Games started crashing.

The reported symptoms are freezes, failures to launch, EXCEPTION_ACCESS_VIOLATION errors and unexpected restarts. ARC Raiders, MARVEL Tōkon: Fighting Souls and The Finals are the titles named.

Microsoft has traced it to something most players did not know was on their machine.

What Microsoft says the cause is

Peripherals and internal components with RGB lighting features install drivers with filenames similar to inpoutx64, and launching certain games with those drivers present triggers the problem.

Microsoft says it is still working to understand the relationship between the RGB components and the affected games. No manufacturer has been named.

The workaround tells you where this lives

Embark Studios, the developer of The Finals, shared a temporary fix: delete the service and remove the inpoutx64 file from the Windows drivers folder.

Read that instruction slowly. It is not "uninstall an app" or "roll back an update". It is: there is a kernel driver on your machine, it belongs to a service, and the fix is to delete it from C:\Windows\System32\drivers.

Which means it was there before, and nobody told you.

What RGB software actually installs

Controlling lighting on a keyboard, a fan or a memory stick means talking to hardware directly, and on Windows that means a driver running in the kernel — the most privileged code on the system, alongside the operating system itself.

So a category of software most people file under decoration ships kernel-level components, on millions of gaming machines, usually bundled with a utility installed once and never opened again.

To be clear about what this story is and is not: nobody has reported a security problem here. This is a compatibility failure, and the only reported consequence is games crashing. What it does is make visible something that was always true and rarely thought about.

The general principle is worth carrying anyway. Software that needs a driver is software you are trusting at the deepest level available, whatever it is for — and the same argument runs through the Defender driver Check Point showed can delete Defender.

What to do

If your games are crashing after KB5121003, check for the driver before assuming your hardware is failing.
Treat the delete-the-driver workaround as temporary. It is a community fix, it will break your lighting control, and Microsoft has not published an official one.
Take stock of what has installed drivers. Most Windows machines carry several nobody remembers agreeing to.
Uninstall lighting utilities you do not use. If the lights are set the way you want them, the daemon usually is not doing anything except existing.

What is not established

Which manufacturers or products. Microsoft has not named any.
The mechanism. Microsoft says it is still working out the relationship.
When an official fix arrives. No date given.
Whether other games are affected. Three are named; the list is the reported one, not necessarily the complete one.

Defender ships a driver built to delete locked files at boot — and its encryption key has been the same since Windows 7

2026-08-22Security

Check Point's Jiří Vinopal reverse-engineered BTR.sys, the Boot Time Removal Tool inside Defender, and showed it can be loaded to delete Defender itself in the window after the filesystem comes up but before the antivirus does. Microsoft says it needs admin rights already, so no patch is planned.

Plugging in a USB device can still get you SYSTEM on a fully patched Windows 11

2026-08-12Gadgets

Presented at DEF CON 34, 'Plug And Pwn' chains Windows' own driver auto-install against itself — emulate a Sierra Wireless modem, then a Sony FeliCa reader, and a DLL lands in System32. There is a Remote Desktop variant too.

Microsoft spent ten years removing one command, because criminals used it more than administrators did

2026-08-21Security

WMIC is not vulnerable. It is a signed Microsoft binary that does exactly what it says, which is why ransomware uses it to delete shadow copies, uninstall antivirus and add Defender exclusions. Deprecated in 2016, finally gone from Windows 11 24H2 and 25H2 — a decade, because you cannot patch a tool that works.

CISA gave agencies three days, not the usual three weeks — the Windows flaw was patched in April and is being exploited now

2026-08-19Security

CVE-2026-33824 is a double free in the Windows IKE Service Extensions, reachable by anyone who can send a UDP packet to port 500 or 4500. Microsoft fixed it in April without flagging exploitation. CISA added it to the exploited catalogue on 18 August and set a three-day patch deadline, which is not what that directive normally allows.

A researcher went round Microsoft's fix in five weeks — ShieldBreak turns Defender itself into the route to SYSTEM

2026-08-19Security

CVE-2026-69414 bypasses July's patch for RoguePlanet using a different technique entirely: a user-mode callback that swaps file contents mid-scan through the Cloud Filter API. Microsoft says a fix is coming. There is no patch, the proof of concept is public, and the only mitigation is turning off the thing doing the protecting.

Four hundred-odd fixes, four unauthenticated RCEs at 9.8 — and the one being exploited scores 7.0

2026-08-13Security

Three outlets counted this Patch Tuesday three different ways, which tells you how little the total matters. CVE-2026-68820 in afd.sys is a use-after-free rated 7.0, Check Point ties it to Lazarus, and the chain starts with a fake job offer.