PC Tools Internet Security CVE-2026-8501

Exploitation requires that PCTCore64.sys from PC Tools Internet Security be loaded on the target system (either because the product is installed or because the signed driver was dropped and loaded in a BYOVD scenario) and that the attacker have local code execution as at least a standard user with the ability to open the \\.\PCTCoreDriver device and issue DeviceIoControl calls. Limiting factors: the attacker must already be local (AV:L) with low privileges (PR:L) and no remote/network path exists; in BYOVD use the attacker also needs sufficient rights to load a kernel driver (typically administrator or an existing kernel primitive), and hosts with the Microsoft Vulnerable Driver Blocklist or WDAC enforcement enabled will refuse to load PCTCore64.sys entirely. No user interaction is required (UI:N) once the driver is accessible.

The CVSS 7.8 score with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a classic local privilege escalation: an attacker needs prior code execution as a low-privileged user but then gains full confidentiality, integrity, and availability impact, almost certainly meaning SYSTEM-level kernel access. KEV status is not indicated and no EPSS score was provided in the input, and there is no public exploit identified at time of analysis, so this is not currently a mass-exploitation candidate. However, vulnerable signed drivers like this are routinely weaponized in Bring-Your-Own-Vulnerable-Driver (BYOVD) attacks by ransomware and APT actors regardless of whether the host has the product installed, which materially raises real-world risk beyond what a 'local PR:L' vector suggests. The 'Information Disclosure' tag in the input understates the impact - the CVSS I:H/A:H and the description's reference to 'privileged operations' point to full kernel compromise, not just info leak; defenders should treat this as an EoP/BYOVD issue.

A local attacker who has already obtained a foothold as a standard user (e.g., via phishing payload, browser exploit, or stolen credentials) opens a handle to \\.\PCTCoreDriver and issues crafted IOCTLs that the driver dispatches without verifying caller privilege, achieving arbitrary kernel read/write or process token manipulation and elevating to SYSTEM. In a BYOVD variant, an attacker without the product installed drops the signed PCTCore64.sys onto a target, loads it as an administrator (or via another EoP), and then abuses the same IOCTL interface to disable EDR or escalate further. No public exploit identified at time of analysis, but the low attack complexity and well-documented WDM IOCTL abuse patterns make weaponization straightforward.