OPSWAT AppRemover CVE-2026-36425

OPSWAT AppRemover Driver (ardrv.sys) must be installed and actively loaded on the target Windows system - it is not present by default and is only found on endpoints where OPSWAT's OESIS Framework has been deployed. The attacker requires an interactive or remote user-mode session on the target machine; any non-privileged local OS account is sufficient. No special driver configuration, elevated token, or specific Windows version is required beyond the driver being present and loaded. Exploitation is strictly limited to the local machine - it cannot be triggered remotely without first obtaining local code execution through a separate vulnerability. The primary limiting factor for defenders is deployment scope: environments that have not deployed OPSWAT AppRemover are entirely unaffected.

The provided NVD CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) contains two significant inconsistencies with the vulnerability description that must be flagged: (1) AV:N (Network) directly contradicts 'any local user can open the device,' which is unambiguously a local attack vector; (2) C:H (High Confidentiality impact) does not correspond to the described impact of process termination, which is an Availability concern rather than a data disclosure concern. These discrepancies suggest the CVSS vector was mis-assigned and should not be used for risk-scoring without vendor clarification. Taking the description at face value, the real-world risk profile is: local vector, low complexity, low privilege, and high availability impact. The GitHub PoC (redteamfortress/CVE-2026-36425) substantially elevates practical risk by lowering the skill bar for exploitation. EPSS data was not provided. No KEV listing means active widespread exploitation is unconfirmed, but the technique is highly attractive for privilege-escalation and defense-evasion kill chains in environments where the driver is deployed.

An attacker with an existing low-privileged shell on a Windows endpoint running the OPSWAT OESIS Framework opens a user-mode handle to the ardrv.sys device and invokes IOCTL code 0x2420031, supplying the PID of a target antivirus or EDR process. Because the driver performs no privilege check, the kernel-level termination request succeeds and the security process is killed silently. A public proof-of-concept at https://github.com/redteamfortress/CVE-2026-36425 enables immediate reproduction with minimal reverse-engineering effort, making this a reliable step in a post-exploitation defense-evasion chain.