IRONMACE Ironshield CVE-2026-97732

Exploitation requires the ability to execute code as a local, unprivileged user on a Windows host running IRONMACE Ironshield 1.0.0.167 with the tvk.sys driver loaded (i.e., a machine with Dark and Darker / the Ironshield anti-cheat installed and running). No authentication, elevated privileges, or user interaction is needed once local access exists. The specific weakness enabling the bypass is that tvk.sys authenticates client executables by checking for the literal publisher string 'IRONMACE Co., Ltd.' and root-certificate string 'DigiCert Trusted Root G4' within WIN_CERTIFICATE data, rather than parsing and cryptographically validating the PKCS signature - so any binary embedding those strings is accepted. The limiting factors are the LOCAL-only attack vector (no remote/network exploitation) and the fact that the payoff is scoped to privileged IOCTL access rather than confirmed full system compromise.

This is a genuine but moderate-severity local vulnerability, correctly scored by NVD/MITRE at CVSS 3.1 5.1 (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). The attack vector is LOCAL (AV:L), so this is not a remotely exploitable, mass-scannable flaw - an attacker must already be able to run unprivileged code on the target machine. Complexity is low (AC:L) and no prior privileges or user interaction are needed (PR:N/UI:N), which makes exploitation trivial once local access exists. There is no EPSS score, no CISA KEV listing, and no vendor advisory in the input; however, a public analysis/POC repository exists (github.com/hseoa/ironshield-analysis), so publicly available exploit code exists - this is a distinct signal from active exploitation, of which there is NO evidence. The realistic risk is that this is a security-control bypass of an anti-cheat/self-protection mechanism rather than a system-compromise primitive: the modest C:L/I:L/A:N impact reflects that the payoff is access to privileged IOCTL functionality, not confirmed kernel code execution or full LPE. Note a possible under-scoring: privileged IOCTL access in a kernel driver COULD chain to higher impact (kernel memory read/write), but the description does not confirm that, so treat any escalation beyond IOCTL access as unverified. Bottom line: real and low-friction for a local attacker, but bounded blast radius and local-only vector keep this off the emergency-patch tier.

A local unprivileged user (e.g., a game player wanting to bypass anti-cheat, or malware already resident on the host) crafts an executable containing forged WIN_CERTIFICATE data that embeds the literal strings 'IRONMACE Co., Ltd.' and 'DigiCert Trusted Root G4'. The tvk.sys driver string-matches those values instead of cryptographically validating the PKCS signature, so it accepts the fake binary as a trusted client and grants it access to privileged IOCTL functions. Public analysis and exploit material is available at github.com/hseoa/ironshield-analysis.