Yun Jia Security Guard EUVD-2026-97363

Requires the Yun Jia Security Guard product (versions up to 2.7.1.9) to be installed with its kgameprotect.sys kernel driver loaded, and the attacker must already possess a local, authenticated low-privileged account on the host (PR:L) with the ability to interact with the driver (e.g., open a device handle and issue requests). Exploitation hinges on reaching function sub_14000885C and supplying an attacker-controlled Pid argument. Limiting factors: no remote exploitation is possible (AV:L), existing local authentication is mandatory, and the product must be present and running - this is not exploitable against systems not using Yun Jia Security Guard.

This is a local privilege escalation flaw (CWE-269, improper privilege management) in the kernel driver kgameprotect.sys of Yun Jia Security Guard, triggered by manipulating the Pid argument to function sub_14000885C. The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L) scores 4.8 (medium) and is internally consistent with the description: local attack vector, low complexity, and an already-authenticated low-privileged user. No EPSS score, no CISA KEV listing, and no POC indicator were provided, and no public exploit is identified at time of analysis, so there is no signal of active or widespread exploitation. The SSVC/exploitation maturity is explicitly undefined (E:X in the vector). The practical risk is therefore moderate-to-low: exploitation requires prior local access as an existing user, which rules out remote mass exploitation, and the stated impact is only partial integrity/availability loss with no confidentiality impact - unusual for a kernel-driver privilege-escalation bug, which typically yields full SYSTEM. This discrepancy (a kernel .sys privilege-management flaw rated only VI:L/VA:L/VC:N) should be verified; if the flaw actually permits arbitrary privilege elevation, real impact would be higher than the 4.8 score suggests. The single reporting source is VulDB, with no vendor advisory (vendor was contacted but did not respond), which limits corroboration.

A local, low-privileged user already logged onto a Windows host running Yun Jia Security Guard sends a crafted request (e.g., an IOCTL) to the kgameprotect.sys kernel driver, supplying a manipulated Pid argument to the vulnerable sub_14000885C function. Because the driver improperly manages privileges based on that attacker-controlled Pid, the user influences a security-relevant operation they should not control, affecting integrity and availability. No public exploit code is identified at time of analysis, and the attack cannot be performed remotely or without an existing local account.