Executive brief
A security vulnerability exists in a legacy Windows driver from PC Tools Internet Security, a discontinued antivirus product. This driver fails to properly restrict who can communicate with it, allowing malicious software already on a computer to perform highly privileged actions. An attacker could use this to steal login credentials, bypass security software like Microsoft Defender, or crash the system.
Technical details
The PCTCore64.sys kernel driver creates a Windows Driver Model (WDM) device object (\\.\PCTCoreDriver) without a restrictive security descriptor, failing to use SDDL or IoCreateDeviceSecure. This allows unprivileged user-mode processes to open handles to the device and issue IOCTL requests. Attackers can leverage these handlers to obtain PROCESS_ALL_ACCESS handles to sensitive processes like lsass.exe, extract NTLM/Kerberos credentials, and terminate Protected Process Light (PPL) processes. While the product is discontinued, the driver remains signed and is susceptible to 'Bring Your Own Vulnerable Driver' (BYOVD) attacks. Organizations should implement Microsoft's recommended driver block rules to mitigate this risk.
Affected products
- PC Tools Internet Security All versions (discontinued)
Timeline
- 2026-03-26: other: Microsoft notified of the vulnerability.
- 2026-06-01: disclosed: Vulnerability details made public by CERT/CC.
- 2026-06-01: advisory: NVD published CVE-2026-8501.