CVE-2026-36425

MEDIUM

OPSWAT AppRemover Driver <= 2017.10.02.1551 - Unauthenticated Local Process Termination via IOCTL 0x2420031

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-36425. PoCs published by redteamfortress.

AI-analyzed exploit summary Detailed technical analysis of CVE-2026-36425, an improper access control vulnerability in OPSWAT AppRemover Driver (ardrv.sys) allowing unprivileged local users to terminate arbitrary processes via IOCTL 0x2420031 without privilege validation. The writeup includes root cause analysis, affected components, and impact assessment.

Description

An issue in OPSWAT AppRemover Driver (ardrv.sys) v2017.10.02.1551 and earlier in IOCTL handler 0x2420031. Any local user can open the device and send process termination requests without privilege validation.

Exploits (1)

nomisec WRITEUP 3 stars
by redteamfortress · poc
https://github.com/redteamfortress/CVE-2026-36425

Detailed technical analysis of CVE-2026-36425, an improper access control vulnerability in OPSWAT AppRemover Driver (ardrv.sys) allowing unprivileged local users to terminate arbitrary processes via IOCTL 0x2420031 without privilege validation. The writeup includes root cause analysis, affected components, and impact assessment.

Classification
Writeup 100%
Attack Type
Other
Complexity
Trivial
Reliability
Reliable
Target: OPSWAT AppRemover Driver (ardrv.sys) v2017.10.02.1551 and earlier
Auth required
Prerequisites: Local user access to the target system · Affected version of ardrv.sys loaded
mistral-large-3 · analyzed Jul 17, 2026 Full analysis →

References (4)

Core 4

Scores

CVSS v3 6.5
EPSS 0.0042
EPSS Percentile 34.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-269
Status published
Published Jul 16, 2026
Tracked Since Jul 17, 2026