Loading vulnerability…
CVE-2026-36425 is an improper privilege-validation vulnerability in OPSWAT AppRemover Driver versions 2017.10.02.1551 and earlier. A user-accessible device interface exposes IOCTL 0x2420031, which reaches kernel process-termination functionality, including ZwTerminateProcess, without sufficient validation of the requesting caller or target process. A local unprivileged user can submit requests to terminate arbitrary processes.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository is a Windows C++ local privilege/driver-loading exploit utility branded as 'EDRKiller'. It is not a network exploit and contains no C2 or remote callback logic. The stated purpose in the README is to abuse CVE-2026-36425 via a vulnerable driver to manipulate processes and kill antivirus/EDR products such as 360 Security and Huorong Security. Repository structure: the root contains a README and a Visual Studio solution/project. The meaningful source files are under cve-2026-36425/cve-2026-36425/: Utils/initdriver.cpp, Utils/service.cpp, Utils/utils.cpp, and headers in include/. The project file references a missing main.cpp and drv_blob.h, indicating the archive is incomplete; however, build logs and project metadata confirm those files existed locally during compilation. The missing drv_blob.h is important because initdriver.cpp expects an embedded driver blob (driver::data / driver::drv_len), which is the actual vulnerable driver payload written to disk. Core behavior: initdriver.cpp generates a random alphabetic driver/service name, derives a path in the TEMP directory, writes the embedded vulnerable driver there, acquires SeDebugPrivilege, and calls service::RegisterAndStart. service.cpp creates HKLM\SYSTEM\CurrentControlSet\Services\<random_name>, sets ImagePath to an NT path (\\??\\<temp path>) and Type=1 for a kernel driver, enables SeLoadDriverPrivilege via RtlAdjustPrivilege, and loads the driver with NtLoadDriver using the native registry path \\Registry\\Machine\\System\\CurrentControlSet\\Services\\<random_name>. The unload path calls NtUnloadDriver, deletes the service key, overwrites the dropped driver file with random bytes, and removes it from disk. Capabilities inferred from code and README: the visible code is a driver dropper/loader and cleanup utility. The README claims the loaded vulnerable driver is then used for process manipulation to terminate AV/EDR processes. That process-killing logic is likely in the missing main.cpp or other omitted code, but the present code clearly establishes the kernel-driver loading mechanism needed for such actions. The code also includes helper routines for querying loaded kernel modules and scanning memory sections/patterns, suggesting intended low-level kernel interaction or symbol/pattern resolution support. Notable observables: registry service creation under HKLM\SYSTEM\CurrentControlSet\Services\<random>, native NtLoadDriver path usage, TEMP-directory driver drop with randomized filename, references to ntdll.dll, and developer build paths under C:\Users\Hezixian\source\repos\.... The project manifest requires administrator execution for Release x64 builds, consistent with the privilege requirements. Assessment: this is a real local exploit utility / offensive tool rather than a detector. Because the actual vulnerable driver blob and main execution logic are partially absent from the provided archive, it is best classified as OPERATIONAL rather than fully weaponized.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A local improper access-control vulnerability in older versions of the OPSWAT AppRemover ardrv.sys driver. The described campaign abuses the vulnerable driver as a bring-your-own-vulnerable-driver (BYOVD) component to terminate security processes, including Microsoft Defender components.
A vulnerability in the OPSWAT AppRemover ardrv.sys driver that attackers abuse through a bring-your-own-vulnerable-driver (BYOVD) technique to gain capabilities for terminating security software.
A local privilege-validation flaw in the OPSWAT AppRemover-associated ardrv.sys driver. Its vulnerable IOCTL 0x2420031 permits inadequately authorized process-termination requests, enabling BYOVD-based impairment of endpoint security controls.
A local privilege/abuse vulnerability in the OPSWAT AppRemover ardrv.sys driver that exposes an insufficiently protected IOCTL allowing arbitrary process termination from kernel mode, enabling defense impairment in BYOVD scenarios.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.