EIP-2026-117381
PRE-CVEKingsoft Antivirus/Internet Security 9+ - Local Privilege Escalation
Title source: legacyExploitation Summary
EIP tracks 1 public exploit for EIP-2026-117381. PoCs published by mr_me.
AI-analyzed exploit summary This is a functional privilege escalation exploit for Kingsoft Antivirus/Internet Security 9+ (KWatch3.sys driver) that leverages a kernel stack buffer overflow via IOCTL 0x80030004 or 0x80030008. The exploit includes shellcode to bypass SMEP and escalate privileges to SYSTEM by manipulating the token of the current process.
Description
Kingsoft Antivirus/Internet Security 9+ - Local Privilege Escalation
Exploits (1)
This is a functional privilege escalation exploit for Kingsoft Antivirus/Internet Security 9+ (KWatch3.sys driver) that leverages a kernel stack buffer overflow via IOCTL 0x80030004 or 0x80030008. The exploit includes shellcode to bypass SMEP and escalate privileges to SYSTEM by manipulating the token of the current process.