Loading vulnerability…
Improper Privilege Validation in OPSWAT AppRemover Driver
CVE-2026-36425 is an improper privilege-validation vulnerability in OPSWAT AppRemover Driver versions 2017.10.02.1551 and earlier. A user-accessible device interface exposes IOCTL 0x2420031, which reaches kernel process-termination functionality, including ZwTerminateProcess, without sufficient validation of the requesting caller or target process. A local unprivileged user can submit requests to terminate arbitrary processes.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker with local code execution can terminate arbitrary processes without appropriate privileges. This can cause denial of service and can impair endpoint defenses by terminating security-product processes, making the vulnerable driver particularly useful for BYOVD-based defense evasion after the driver has been installed and loaded.
If you can’t patch tonight, do this now.
Prevent installation and loading of vulnerable kernel drivers using application control and driver block policies, including Microsoft’s vulnerable-driver blocklist where applicable. Restrict local administrative and driver-installation privileges, and monitor for unexpected kernel-driver service creation and loading.
Patch, then assume compromise.
Upgrade OPSWAT AppRemover Driver to a version later than 2017.10.02.1551 that corrects the IOCTL privilege-validation flaw. Remove legacy vulnerable driver installations where an updated version is unavailable.
1 exploit validated by Mallory's analysis. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.