EUVD-2026-54368
GHSA-hfv4-4vhj-6536
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack requiring low-privilege user session against ZyArk.sys; no scope change, full C/I/A impact on vulnerable host only.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability has been found in V-Secure Jingyun Antivirus 2.4.2.39. The affected element is an unknown function in the library ZyArk.sys of the component Kernel Driver. The manipulation leads to improper access controls. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Improper access control in V-Secure Jingyun Antivirus 2.4.2.39 allows a local low-privileged user to interact with the ZyArk.sys kernel driver in ways that bypass intended access restrictions, yielding high-impact compromise of confidentiality, integrity, and availability on the affected host. A publicly available proof-of-concept exploit (E:P per the CVSS 4.0 vector) lowers the bar for exploitation, though the local-only attack vector limits the exposure to already-authenticated users or post-initial-access scenarios. The vendor was contacted prior to disclosure but did not respond, meaning no official patch exists at time of analysis.
Technical ContextAI
The vulnerability resides in ZyArk.sys, a Windows kernel-mode driver shipped with V-Secure Jingyun Antivirus (CPE: cpe:2.3:a:v-secure:jingyun_antivirus:*:*:*:*:*:*:*:*). Kernel drivers operate at Ring 0 - the highest privilege level - and expose device I/O control (IOCTL) interfaces or other kernel APIs to user-mode processes. CWE-284 (Improper Access Control) indicates the driver fails to enforce adequate authorization checks on these interfaces, allowing a low-privileged caller to invoke privileged operations or access kernel memory structures beyond their entitlement. This class of vulnerability in antivirus kernel drivers has historically been leveraged for local privilege escalation, security-product bypass, or both, since AV kernel drivers routinely hold broad system access by design.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to coordinated disclosure contact. Organizations running Jingyun Antivirus 2.4.2.39 should consider removing or replacing the product until a patched release is published, as no confirmed fix version exists. As a compensating control, restrict local user account privileges to the minimum required, reducing the pool of principals who could invoke the vulnerable IOCTL interface - this limits but does not eliminate exposure since PR:L exploitation only requires a standard local user session. Applying allowlisting or kernel driver signing policies (e.g., Windows HVCI / Memory Integrity) may prevent unsigned or improperly signed drivers from loading, though this depends on the driver's current signing status. Monitor for anomalous kernel driver interactions using EDR telemetry on systems running this product. Track the VulDB entry at https://vuldb.com/vuln/386712 and the vendor's official channels for any future patch release.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today