EUVD-2026-89424
GHSA-q22r-qwfg-76wv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local low-privileged foothold
-
DeliveryOpen handle to ArgusMonitor.sys device
-
ExploitWin TOCTOU race in IRP_MJ_CREATE
-
ExecutionSend crafted IOCTL 0x9C4024A8
-
ImpactCrash driver, local denial-of-service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture TOCTOU prevention
|
| Exploitation Conditions | Requires an existing local foothold as a low-privileged user on a Windows host running Argus Monitor 7.4.02 or earlier, because the vulnerable ArgusMonitor.sys kernel driver must be installed and loaded. The attacker must open a handle to the driver's device object and win a time-of-check/time-of-use race against the access restriction enforced in IRP_MJ_CREATE, then deliver the specific crafted IOCTL 0x9C4024A8. Limiting factors: no network reachability (despite the AV:N in the vendor vector, the mechanism is a local DeviceIoControl call), the high attack complexity of reliably winning the TOCTOU race (AC:H), and impact limited to denial-of-service (system/driver crash) with no confidentiality or integrity effect. |
| Impact | This is a genuinely LOW-priority issue despite the medium 5.3 CVSS. The most important signal is a vector contradiction: the vendor (MITRE) CVSS vector states AV:N (network), but the description explicitly scopes exploitation to 'local, low-privileged users' sending a crafted IOCTL to a Windows kernel driver (ArgusMonitor.sys). A kernel-mode IOCTL/DeviceIoControl path is inherently local - AV:N is almost certainly an error and the real attack vector is AV:L; verify with vendor. The SSVC framework reinforces low urgency: Exploitation=none (no observed exploitation), Automatable=no, and Technical Impact=partial. The impact is confined to availability (C:N/I:N/A:H) - a local denial-of-service (system crash/BSOD), not code execution or privilege escalation. AC:H reflects the TOCTOU race window that must be won reliably. No EPSS score and no KEV listing are provided, and the sole technical reference is an independent researcher blog describing the local-DoS, which the SSVC 'Exploitation: none' rating treats as not-yet-exploited. Net: a local, race-dependent, availability-only bug in a niche consumer monitoring utility - not an urgent, remotely-exploitable priority. |
| Exploit ScenarioDerived | A low-privileged local user (or malware already running on the host) opens a handle to the ArgusMonitor.sys device, wins the time-of-check/time-of-use race in IRP_MJ_CREATE to bypass the device-handle access restriction, then issues the crafted IOCTL 0x9C4024A8 to crash the driver and deny service to the local system. A detailed technical write-up exists publicly (connorjaydunn blog), but SSVC records no observed exploitation and the attack requires winning a race (AC:H). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Improper access control in the ArgusMonitor.sys kernel driver shipped with Argotronic eGbR Argus Monitor 7.4.02 and earlier lets a local, low-privileged user win a TOCTOU race in IRP_MJ_CREATE to obtain a handle to the driver's device object, then issue a crafted IOCTL 0x9C4024A8 that crashes the driver and causes denial-of-service on the affected Windows host. The attack requires an existing local foothold on a machine where the driver is installed and loaded, and success depends on reliably winning a timing race, which is why it is rated high complexity and low overall priority despite the medium 5.3 base score. Impact is limited to availability (system/driver crash) with no confidentiality or integrity effect; there is no vendor-released patch identified at time of analysis and no public exploit identified at time of analysis (CISA SSVC records Exploitation: none).
RemediationAI
No vendor-released patch is identified at time of analysis, so remediation must be compensating and risk-based. On multi-user or untrusted-access endpoints, the most reliable control is to remove or disable the ArgusMonitor.sys driver entirely (uninstall Argus Monitor or disable the driver service) where temperature/fan monitoring is not required - the trade-off is loss of the monitoring functionality. Where Argus Monitor must remain, tighten the device object's security descriptor so that only administrators and the specific monitoring service can open a handle (restricting low-privileged users removes the PR:L prerequisite), accepting that this requires a vendor-supplied or custom driver build and may be overwritten by updates. Enforce Windows Defender Application Control / driver blocklisting or enable Microsoft's vulnerable-driver blocklist so untrusted or unsigned kernel drivers cannot be loaded, and enable HVCI where hardware supports it; these controls can break legitimate older or unsigned drivers and should be piloted first. Finally, treat low-privileged local accounts on Argus Monitor hosts as untrusted, monitor for DeviceIoControl traffic referencing IOCTL 0x9C4024A8 against the Argus device object, and apply the latest Argus Monitor release once Argotronic publishes a fix. Advisory references: https://nvd.nist.gov/vuln/detail/CVE-2026-79417 (EUVD advisory) and the researcher write-up https://connorjaydunn.github.io/blog/posts/argus-monitor-ldos-cve-2026-79417/.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic time-of-check/time-of-use (TOCTOU) weakness (CWE-367) inside a Windows kernel-mode driver. ArgusMonitor.sys creates a device object and is expected to enforce access restrictions on the object during IRP_MJ_CREATE (the handle-open path), but the check and the subsequent grant of access are not atomic. A local caller that repeatedly attempts to open the device can, under the right timing, obtain a handle that the restriction was intended to deny, after which a DeviceIoControl call with IOCTL 0x9C4024A8 reaches an unguarded code path in the driver. The mechanism is a local DeviceIoControl interaction, not a network-reachable service: although the vendor vector carries AV:N, the assessed vector is AV:L with AC:H and PR:L, reflecting that a low-privileged local user with an existing foothold is required. The CPE data supplied is a placeholder (n/a:n/a) and does not enumerate a resolvable product entry, but the affected component is definitively the ArgusMonitor.sys driver distributed with Argus Monitor 7.4.02 and earlier; the ENISA EUVD record (EUVD-2026-89424) also carries 'n/a' version data, so version scoping relies on the vendor statement '7.4.02 and earlier'.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Local kernel-driver IOCTL so AV:L (not vendor's AV:N); TOCTOU race gives AC:H; any local user can open the device so PR:L; availability-only crash so C:N/I:N/A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
Improper Access Control in ArgusMonitor.sys in Argotronic eGbR ArgusMonitor 7.4.02 and earlier allows local, low-privileged users to bypass device handle access restrictions via a TOCTOU condition in IRP_MJ_CREATE and send a crafted IOCTL 0x9C4024A8 request, causing denial-of-service.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Exploit-DB