OPSWAT AppRemover

CVE-2026-36425 – Improper Access Control in Kernel Driver Leading to Arbitrary Process Termination (BYOVD)

Affects

• OPSWAT AppRemover (utility for cleanly removing third-party applications)
• Versions:
  • ardrv.sys v2017.10.02.1551 and earlier
• Components:
  • Kernel driver (ardrv.sys)
  • IOCTL handler (0x2420031)
• Files:
  • ardrv.sys (16 vulnerable driver variants identified, all validly signed by OPSWAT)
• Functions:
  • DriverEntry
  • IOCTL dispatch chain

Affected Products (embedding the vulnerable driver):

• OESIS Framework
• MetaDefender Endpoint
• Other OPSWAT products that included ardrv.sys as a component

NOT VULNERABLE:

• OESIS Framework versions released June 25, 2026 or later (replaced ardrv.sys with libwasys.sys v10.3.5429.0)
• MetaDefender Endpoint v7.6.2606.1036 or later
• Systems where the legacy ardrv.sys driver has been removed or disabled
• Microsoft has added ardrv.sys to its block list effective September 1, 2026

Description

CVE-2026-36425 is a medium-severity improper access control vulnerability in OPSWAT’s legacy AppRemover kernel driver (ardrv.sys), discovered by researcher Jehad Abudagga (@j3h4ck) .

The driver exposes a device object (\\.\ardrv) that is accessible to any local user without privilege validation. The IOCTL handler 0x2420031 performs process termination on a caller-supplied PID using three distinct methods, all executing in kernel context :

1. Memory corruption: Attaches to the target process via KeAttachProcess and overwrites the first 4096 pages with 0xCC (INT3 breakpoints), forcing a crash.
2. Direct termination: Opens the process via ObOpenObjectByPointer and calls ZwTerminateProcess.
3. Job object termination: Creates a Job Object, assigns the target process to it, and terminates the entire job via ZwTerminateJobObject.

All three methods lack caller validation, privilege checks, and protection for critical or PPL-protected processes. This enables Bring Your Own Vulnerable Driver (BYOVD) attacks, where an attacker loads the signed driver to terminate security software (EDR, antivirus) and disable system protections .

Key technical characteristics:

• CWE: CWE-269 (Improper Privilege Management) / CWE-284 (Improper Access Control)
• CVSS v3.1 Score: 6.5 (Medium)
• Attack vector: Network (CVSS) / Local (practical)
• Authentication required: Yes (attacker must have local user access)
• User interaction: None
• Public PoC: Yes – multiple repositories available
• Active exploitation: Confirmed – VulnCheck KEV listed (August 26, 2026)

Attack Vector

Primary Attack Vector:
Local (requires local user access to load the vulnerable driver)

Attack Scenario (BYOVD):

1. An attacker obtains a low-privileged local account or code execution on a target Windows system.
2. The attacker loads the signed ardrv.sys driver (one of 16 variants) using sc.exe create and sc.exe start .
3. The attacker runs a PoC tool (e.g., ardrvkiller.exe <PID>) that opens the \\.\ardrv device and sends IOCTL 0x2420031 with the target process PID .
4. The driver terminates the target process from kernel mode without any privilege validation.
5. The attacker terminates EDR/AV agents, PPL-protected processes, or other security software, disabling system protections.

Key Characteristics:

Conditions Affecting Risk:

• The vulnerable ardrv.sys driver must be present on the system (bundled with OPSWAT products)
• Attacker must have local user access to load the driver
• Windows systems without driver blocklist protection (prior to September 1, 2026, when Microsoft added ardrv.sys to its block list)

Impact

Successful exploitation allows a local attacker to:

• Terminate any process on the system, including EDR, antivirus, and PPL-protected security processes
• Disable security software, enabling further attacks without detection
• Bypass endpoint protections through a BYOVD attack technique
• Cause denial of service by terminating critical system processes
• Weaken the security posture of the affected system

Important: The practical impact is security control bypass – the ability to terminate security software is a critical enabler for subsequent attacks. The CVSS score (6.5) does not fully reflect the operational risk in environments where the driver is present .

Observed Exploitation & Threat Activity

• Discovery: Jehad Abudagga (@j3h4ck)
• CVE Request Submitted: February 25, 2026
• CVE Published: July 16, 2026
• Public PoC: Yes – redteamfortress/CVE-2026-36425 on GitHub (24 stars, 18 files)
• Additional PoC: gongchuang1089/EDRKiller (tool that exploits the vulnerability to terminate EDR processes)
• In-the-Wild Exploitation: Confirmed – VulnCheck KEV listed August 26, 2026, with reported exploitation observed
• CISA SSVC Assessment: Exploitation: None (as of July 17, 2026, before VulnCheck KEV listing)
• EPSS Score: 0.42%

Disclosure Timeline:

Vendor Response (OPSWAT):
OPSWAT confirmed the vulnerability was identified and fixed in June 2026. The legacy ardrv.sys driver was deprecated and replaced with libwasys.sys v10.3.5429.0. The fix was released June 25, 2026, and affected customers were notified. OPSWAT also notified Microsoft, which added ardrv.sys to its driver block list effective September 1, 2026 .

Severity & Metrics

• CVSS v3.1 (CISA-ADP): Medium (6.5)
• Attack Vector: NETWORK
• Attack Complexity: LOW
• Privileges Required: LOW
• User Interaction: NONE
• Scope: UNCHANGED
• Confidentiality Impact: HIGH
• Integrity Impact: NONE
• Availability Impact: NONE

Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Relevant CWE:

• CWE-269 – Improper Privilege Management
• CWE-284 – Improper Access Control (PoC classification)

MITRE ATT&CK Technique: T1068 (Exploitation for Privilege Escalation) / T1562.001 (Impair Defenses: Disable or Modify Tools)

Patch & Vendor Status

• Official Patch Available: Yes – OPSWAT replaced the vulnerable driver in OESIS Framework and MetaDefender Endpoint on June 25, 2026
• Vendor: OPSWAT, Inc.
• Fix Details: The legacy ardrv.sys driver was deprecated and replaced with libwasys.sys v10.3.5429.0, which was thoroughly reviewed and tested to ensure it does not contain the security flaw

Fixed Versions:

Microsoft Driver Blocklist:

• ardrv.sys added to Microsoft’s driver block list effective September 1, 2026

Update Methods:

Mitigation & Remediation

Immediate Actions

Short-Term Defensive Measures

If patching cannot be applied immediately:

• Block the driver via security software – Use EDR or application control to prevent loading of ardrv.sys
• Restrict local user access – Limit who can log into affected systems
• Monitor for BYOVD activity – Watch for unusual driver loading events, especially ardrv.sys
• Enable HVCI (Hypervisor-Enforced Code Integrity) where available

Important Note: The vulnerability is actively exploited. Patching or blocking the driver is critical .

Long-term Defensive Measures

• Implement a BYOVD defense strategy – Use Microsoft’s vulnerable driver blocklist and maintain an allowlist of permitted drivers
• Maintain an inventory of kernel drivers across the organization
• Audit third-party software components for embedded vulnerable drivers
• Monitor vendor security advisories for OPSWAT and other security software vendors

Detection & Monitoring

Recommended Detection Sources:

Indicators of Attempted Exploitation:

• Loading of ardrv.sys – Especially from unexpected locations or by non-system processes
• Unexpected termination of security processes – EDR/AV agents, PPL-protected processes
• Use of sc.exe create / sc.exe start to load the driver
• Presence of PoC tools (ardrvkiller.exe, EDRKiller) on endpoints
• Driver hashes matching known variants (16 SHA256 hashes available in the PoC repository)

Detection Strategy:

1. Inventory systems for the presence of ardrv.sys using the known hashes
2. Check driver load events in Windows Event Logs
3. Monitor for unexpected security process termination – correlate with driver load events
4. Verify Microsoft driver blocklist status on Windows systems

Vulnerable Driver Hashes (sample):

Post-Incident Response

If exploitation is suspected:

1. Isolate affected system from the network immediately
2. Preserve forensic evidence (Windows Event Logs, driver load history, process termination events, memory dumps)
3. Identify which processes were terminated – check for gaps in security logging
4. Remove the vulnerable driver – Delete ardrv.sys and associated services
5. Update OPSWAT products to versions that replace the driver
6. Audit for further compromise – If security software was disabled, assume the system may have been compromised
7. Rebuild system from a trusted, clean installation if compromise is confirmed
8. Document and report findings to internal security teams

For Enterprise Environments:

• Apply OPSWAT updates through enterprise deployment tools
• Deploy Microsoft’s driver blocklist to all Windows systems
• Scan all endpoints for the presence of ardrv.sys using known hashes
• Monitor for BYOVD attack patterns across the environment

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-36425
• https://github.com/redteamfortress/CVE-2026-36425
• https://www.opswat.com/docs/mdsdk/release-notes/cve-2026-36425
• https://www.opswat.com/blog/security-update-addressing-the-opswat-legacy-appremover-driver-and-cve-2026-36425
• https://cwe.mitre.org/data/definitions/269.html