EUVD-2026-34989
GHSA-pw43-h2x7-pm54
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in SecureAge CatchPulse up to 10.9.1. Impacted is an unknown function in the library saappctl.sys of the component IOCTL Handler. The manipulation leads to information disclosure. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Information disclosure in SecureAge CatchPulse (versions up to 10.9.1) is triggered through an improperly secured IOCTL handler within the saappctl.sys kernel-mode driver, allowing a low-privileged local user to extract sensitive data from the driver's memory space. A public proof-of-concept exploit exists per VulDB reporting, increasing the likelihood of opportunistic local use - particularly as a reconnaissance step within a broader privilege escalation chain. No vendor patch has been issued and the vendor did not respond to coordinated disclosure, leaving all installations of affected versions unmitigated.
Technical ContextAI
SecureAge CatchPulse is an endpoint protection product that installs the kernel-mode driver saappctl.sys on Windows systems. Kernel drivers expose IOCTL (Input/Output Control) interfaces to allow user-mode processes to request services from the driver. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) indicates that the driver's IOCTL handler does not adequately restrict what data is returned in response to certain control codes, enabling a caller with only low operating system privileges to obtain information from kernel space that should be inaccessible. The CPE string cpe:2.3:a:secureage:catchpulse:*:*:*:*:*:*:*:* confirms the flaw is in the application layer of CatchPulse itself, not an underlying OS component. Because security software drivers typically run at high kernel privilege levels, mishandled IOCTL responses can expose sensitive system state, memory addresses, or internal driver data.
RemediationAI
No vendor-released patch has been identified at time of analysis. The vendor did not respond to the researcher's coordinated disclosure, and no official SecureAge advisory is available. As a compensating control, organizations should restrict which user accounts or processes can open handles to the saappctl.sys device object - this can be enforced through Windows Device Control policies or driver access ACLs to limit IOCTL access to SYSTEM or elevated processes only, though this may interfere with CatchPulse's own user-mode components. Additionally, deploying application control policies (e.g., via Windows Defender Application Control or a third-party allowlisting tool) to block unauthorized IOCTL-capable binaries from running reduces opportunistic exploitation surface. Security teams should monitor for unusual handle-open events on saappctl.sys using EDR telemetry. If CatchPulse is not operationally critical, temporary uninstallation removes the attack surface entirely. Reference: https://vuldb.com/vuln/369078 and the researcher's POC document at https://vandalsuidaho-my.sharepoint.com/:w:/g/personal/higg2059_vandals_uidaho_edu/IQBo2bcYM-FJTpon1vC0En0vAS3OerOp4Nf0EeZIU4u9mgY?e=XAT64X.
More in Catchpulse
View allSame weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today