As reported by BleepingComputer, Microsoft has confirmed that August 2026 Windows updates (KB5121003 and later) are causing games to crash or fail to launch on Windows 11 24H2 and 25H2 systems, and the culprit appears to be RGB lighting peripherals. Specifically, a kernel driver called inpoutx64.sys — bundled with many RGB control utilities — is at the center of the conflict. Embark Studios, developer of affected titles like ARC Raiders and The Finals, has confirmed the crash relates to kernel driver changes in the update.

Key Takeaway: While the gaming community sees crashes and freezes, security analysts see something more concerning: inpoutx64.sys is a generic kernel-mode driver that exposes direct I/O port access to user-mode applications.

Why inpoutx64.sys Matters Beyond Gaming

While the gaming community sees crashes and freezes, security analysts see something more concerning: inpoutx64.sys is a generic kernel-mode driver that exposes direct I/O port access to user-mode applications. In practical terms, any process running on a system with this driver installed can read and write to arbitrary hardware I/O ports — bypassing normal Windows access controls. This class of driver has been flagged by security researchers for years as an attractive target for privilege escalation and firmware-level manipulation.

The fact that RGB lighting software — often from peripheral manufacturers with minimal security oversight — routinely installs a driver granting this level of hardware access should give defenders pause. These drivers are typically signed but poorly maintained, widely distributed, and rarely updated. They represent exactly the kind of third-party kernel attack surface that Microsoft has been trying to reduce through its driver block list and HVCI enforcement.

The gaming disruption may be an unintended side effect of kernel hardening changes that are, from a security standpoint, moving in the right direction.

Broader Implications for Enterprise Defenders

This incident fits a recurring pattern: third-party kernel drivers conflicting with Windows kernel changes. We've seen it with anti-cheat drivers, antivirus products, and now RGB lighting utilities. For enterprise environments, the takeaway is not about gaming — it's about driver governance.
Broader Implications for Enterprise Defenders
Shadow drivers in corporate estates: RGB control software is unlikely to be on any enterprise approved-software list, yet these drivers may be present on employee machines, especially in hybrid/work-from-home environments where personal peripherals are common.
Kernel attack surface expansion: Every third-party kernel driver installed is additional attack surface. Drivers like inpoutx64.sys that provide direct hardware access are particularly risky — they've been leveraged in real-world exploits to bypass kernel protections.
Update testing friction: Kernel-level conflicts like this one can cause unexpected reboots and application failures that disrupt productivity, not just gaming. Enterprise update rollouts need to account for driver-level regressions.

The Unofficial Workaround Carries Its Own Risk

Embark Studios has shared a workaround that involves deleting the inpoutx64 service and removing the driver file from the Windows drivers folder. While this resolves the gaming crash, it also highlights how trivially these drivers can be manipulated. If a game developer can instruct users to manually remove a kernel driver, an attacker with user-level access can likely do the same — or worse, replace it with a trojanized version. Defenders should be monitoring for unauthorized modifications to driver files and services, particularly in non-standard locations.

Shield53 Recommendations

  • Inventory kernel drivers across your estate: Use tools like driverquery, Microsoft Defender for Endpoint, or commercial EDR solutions to identify systems running inpoutx64.sys or similar generic I/O access drivers. Flag any that aren't on an approved list.
  • Enable Microsoft's recommended driver block rules: Ensure Windows Defender Application Control driver block lists are active. These are designed to block known-vulnerable and abusive drivers — exactly the category inpoutx64.sys falls into.
  • Restrict peripheral control software: Use application control policies to prevent installation of RGB lighting utilities and similar consumer peripheral management tools on corporate-managed devices.
  • Monitor for driver tampering: Deploy detection rules for modifications to driver files in C:\Windows\System32\drivers\ and changes to driver service registry entries, especially outside of approved maintenance windows.
  • Stage Windows updates with driver conflict testing: Before broad rollout of monthly cumulative updates, test against a pilot group that includes systems with known third-party kernel drivers. Monitor for EXCEPTION_ACCESS_VIOLATION events and unexpected reboots.
  • Enable HVCI where possible: Hypervisor-Protected Code Integrity provides kernel-level protection against unsigned or tampered driver code. It won't fix the RGB crash, but it reduces the risk these drivers pose as an attack vector.

Microsoft is still investigating the root cause and has not yet shipped an official fix. Until then, the gaming disruption is a visible symptom of an invisible problem — the ongoing tension between consumer hardware control software and kernel security. Defenders should use this moment to clean house on third-party drivers before someone else does it for them.