EIP-2026-117381

This is a functional privilege escalation exploit for Kingsoft Antivirus/Internet Security 9+ (KWatch3.sys driver) that leverages a kernel stack buffer overflow via IOCTL 0x80030004 or 0x80030008. The exploit includes shellcode to bypass SMEP and escalate privileges to SYSTEM by manipulating the token of the current process.