CVE-2026-36425

CVE-2026-36425 : OPSWAT AppRemover Arbitrary Process Termination A signed OPSWAT kernel driver that kills any process on demand. No admin rights needed, no privilege checks, no questions asked. Point it at an EDR, an antivirus, a PPL-protected process and it dies. Three different kill methods, al...

VulnCheck KEV: CVE-2026-36425

An issue in OPSWAT AppRemover Driver ardrv.sys v2017.10.02.1551 and earlier in IOCTL handler 0x2420031. Any local user can open the device and send process termination requests without privilege validation...

PT-2026-60576

Name of the Vulnerable Software and Affected Versions OPSWAT AppRemover versions prior to 2017.10.02.1551 Description An issue exists in the IOCTL handler 0x2420031 of the OPSWAT AppRemover Driver ardrv.sys. This flaw allows any local user to open the device and send process termination requests...

CVE-2026-36425

An issue in OPSWAT AppRemover Driver ardrv.sys v2017.10.02.1551 and earlier in IOCTL handler 0x2420031. Any local user can open the device and send process termination requests without privilege validation...