Junglewise Threat Intelligence

CVE-2026-36425: OPSWAT AppRemover Driver improper access control in IOCTL handler

CVE-2026-36425 · Severity: info · Published 2026-07-16

Executive brief

A vulnerability in the OPSWAT AppRemover kernel driver allows any local user to terminate arbitrary running processes, including security software and critical system components. This driver is part of a tool used to uninstall applications, but because it is digitally signed, it can be misused by attackers to disable antivirus protection or crash the operating system. An exploit could allow an attacker to bypass security controls or cause a total system outage.

Technical details

The OPSWAT AppRemover kernel driver (ardrv.sys), version 2017.10.02.1551 and earlier, exposes a device object (\\.\ardrv) with insufficient access permissions, making it reachable by non-administrative users. The IOCTL handler 0x2420031 facilitates process termination using three methods: memory corruption via KeAttachProcess (overwriting 16MB with 0xCC), job object termination, or direct ZwTerminateProcess calls. The driver fails to perform any privilege validation on the caller or check the protection status (PP/PPL) of the target process. This allows a local attacker to disable EDR/AV agents or cause a denial of service by killing critical system processes. This driver is also a candidate for 'Bring Your Own Vulnerable Driver' (BYOVD) attacks.

Affected products

  • OPSWAT AppRemover Driver (ardrv.sys) v2017.10.02.1551 and earlier

Timeline

  • 2026-02-25: other: CVE request submitted
  • 2026-06-16: other: CVE assigned
  • 2026-06-17: disclosed: Public advisory published by researcher
  • 2026-07-16: advisory: NVD published date

References