EUVD-2026-54359
GHSA-rr8j-hjqf-g6cv
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local low-privilege access suffices; no scope change as kernel driver impact is confined to the local vulnerable system with no cross-system propagation.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A flaw has been found in Jiangmin Antivirus 21. Impacted is the function MessageNotifyCallback in the library kvcore.sys of the component Minifilter Port. Executing a manipulation can lead to improper access controls. The attack needs to be launched locally. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Local privilege escalation in Jiangmin Antivirus 21 exploits improper access controls in the kernel-mode driver kvcore.sys, specifically within the MessageNotifyCallback function of the Minifilter Port component. A low-privileged local attacker can send crafted messages to this communication port to bypass access enforcement, achieving high impact across confidentiality, integrity, and availability on the affected system. No public exploit identified at time of analysis is incorrect here - a publicly available exploit exists on GitHub, and the vendor did not respond to responsible disclosure, leaving no patch available.
Technical ContextAI
The vulnerability resides in kvcore.sys, a kernel-mode minifilter driver shipped with Jiangmin Antivirus 21 (CPE: cpe:2.3:a:jiangmin:antivirus:*:*:*:*:*:*:*:*). Windows Minifilter drivers use the Filter Manager's communication port mechanism to facilitate messaging between user-mode processes and kernel-mode drivers. The MessageNotifyCallback function is registered to handle inbound messages on this port. CWE-284 (Improper Access Control) indicates that this callback does not adequately validate the identity, privilege level, or integrity of the calling process before acting on received messages, allowing an unprivileged caller to influence kernel-level driver behavior. This is a well-understood attack class against AV kernel drivers, often used for privilege escalation or security product disablement.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to responsible disclosure. As compensating controls, administrators should restrict local interactive and remote desktop access to systems hosting Jiangmin Antivirus 21, ensuring only trusted users can execute code on those endpoints, since exploitation requires local code execution with at least low privileges. Where feasible, organizations should evaluate replacing Jiangmin Antivirus 21 with an actively maintained endpoint security product. Windows AppLocker or WDAC policies can be used to restrict which processes are permitted to open handles to minifilter communication ports, reducing the effective attack surface of kvcore.sys. Monitor for unexpected privilege escalation events or unusual kernel driver interaction on affected hosts. No patch version exists to reference from available data.
The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5
The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7,
The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast!. Rated medium severity (CVSS 4.3), t
The RAR file parser in ClamAV 0.96.4, Rising Antivirus 22.83.00.03, Quick Heal (aka Cat QuickHeal) 11.00, G Data AntiVir
In Avast Antivirus before v17, using the LPC interface API exposed by the AvastSVC.exe Windows service, it is possible t
K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025c8 DeviceIoControl request
K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025a4 DeviceIoControl request
K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025ac DeviceIoControl request
K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x95002574 DeviceIoControl request
K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x95002570 DeviceIoControl request
An issue was discovered in Avast Antivirus before 20. Rated critical severity (CVSS 9.8), this vulnerability is remotely
Privilege escalation vulnerability in the Self-Defense driver of Avast Antivirus prior to 20.8 allows a local user with
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today