N A EUVD-2025-209526

Exploitation requires three specific conditions that significantly limit attack surface: (1) The attacker must have LOCAL access to the target system (AV:L in CVSS) and cannot exploit this remotely via network. (2) The attacker must already hold at least LOCAL PRIVILEGED USER context (PR:L) - either a compromised admin account, a service account running with elevated privileges, or user-mode code executing in a privileged process. (3) The Safetica Application suite (specifically STProcessMonitor driver version 11.11.4.0 or affected versions) must be installed and the driver must be loaded in kernel memory; if Safetica is not present, the IOCTL handler cannot be reached. The vulnerability does NOT require user interaction (UI:N), meaning the attacker does not need to trick a user into approving a prompt. The SCOPE is UNCHANGED (S:U), meaning exploitation does not escape the current privilege context to affect other users or system components directly - but the denial of service impact (terminating processes) can cascade. Exploitation is NOT automatable (SSVC: Automatable: no), as each target system requires the attacker to know which process to terminate and to execute code with sufficient privilege; this rules out worm-like or mass-exploitation scenarios.

CVSS 5.5 with local attack vector (AV:L), low complexity (AC:L), and low privilege requirement (PR:L) reflects moderate real-world risk. CISA's SSVC framework assessment lists this as 'Exploitation: poc' (publicly available exploit code), 'Automatable: no' (requires local access and specific privilege), and 'Technical Impact: partial' (denial of service only, no confidentiality or integrity compromise). The combination of low CVSS but confirmed POC availability indicates this is a targeted privilege-escalation vector rather than a mass-exploitation vulnerability. Key limiting factors: requires local system access (not remote), requires at least local admin or privileged user context (PR:L), and the attack is not automatable in a worm-like sense. However, within enterprise environments where multiple applications run with elevated privileges, this becomes a realistic lateral-movement and defense-evasion technique - an attacker with user-level code execution could escalate to disabling third-party EDR/EPP solutions. The LOLDrivers tracking and proof-of-concept code suggest this is actively weaponized in targeted campaigns rather than opportunistic exploitation. Real risk is HIGH in contexts where process termination capability could disrupt critical operations or where third-party security tools are the primary defense layer.

An attacker with local user privileges (e.g., compromised standard user account or low-privilege service) loads or triggers the STProcessMonitor kernel driver and sends IOCTL request 0xB822200C with a crafted payload specifying a target process ID. The driver's insufficient caller validation fails to detect the unauthorized request, and the kernel-mode handler terminates the target process (e.g., McAfee, Windows Defender, or third-party EDR agent) that is normally protected from user-mode termination. This causes denial of service to critical security monitoring, enabling follow-on malware execution or lateral movement without endpoint visibility.