Executive brief
Protegent 360 is an antivirus and data security suite designed to protect Windows systems from malware and unauthorized file access. A vulnerability in its kernel drivers allows any local user, including those with restricted guest accounts, to deliberately crash the computer, resulting in a Blue Screen of Death (BSOD). This can be used to disrupt business operations, cause data loss in unsaved applications, and bypass the system's security protections by forcing a reboot.
Technical details
A denial of service vulnerability exists in the Secure Folders driver (wscsrv.sys version 1.0.0.9) of Protegent 360 v2.0.0.4. The driver creates a device object (\Device\FE79F7D853E643089D51EDCDA79805C4) with no access control (CWE-732), allowing any unprivileged local user to send IOCTL requests. Specifically, the function sub_13828 fails to properly validate memory allocation results from ExAllocatePool, leading to a NULL pointer dereference (CWE-476) when the system is under memory pressure or provided with specific inputs. This results in a SYSTEM_SERVICE_EXCEPTION bug check (BSOD). No patch is currently confirmed, though the researcher suggests the vendor lacks basic access control checks across multiple driver components.
Affected products
- Unistal Systems Pvt. Ltd. Protegent 360 2.0.0.4
Timeline
- 2026-05-21: disclosed: Initial researcher disclosure by DreadSec
- 2026-07-22: advisory: CVE published to NVD