CVE-2026-36425

Description

"An improper access control vulnerability in the OPSWAT AppRemover kernel driver (ardrv.sys) on Windows devices allows a locally authenticated non-administrative Windows user to open the driver's device object and issue privileged process-termination requests without any privilege validation." The affected ardrv.sys driver is a legacy component (used in production from August 2017 through June 2022) that was superseded by libwasys.sys; both drivers exposed the same class of unvalidated IOCTL handlers, and the issue has been remediated in the current SDK by hardening the driver's device security descriptor so that only Administrators, LocalService, and SYSTEM may open it.

References

• CVE-2026-36425

• NVD - CVE-2026-36425

• https://www.opswat.com/products/oesis-framework/application-removal

Severity

• CVSS-B: 6.5

• Rating: Medium

• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness Enumeration

• CWE-269: Improper Privilege Management

• CAPEC-233: Privilege Escalation

Known Software Configurations

OPSWAT AppRemover kernel driver ardrv.sys version 2017.10.02.1551 and earlier. The vulnerable ardrv.sys driver was replaced by libwasys.sys in June 2022. The equivalent hardening for libwasys.sys is included in OESIS SDK package version 4.3.6259.0 and AppRemover package version 4.3.113 (released June 25th, 2026) and later.

Remediation

Update to OESIS SDK package version 4.3.6259.0 or later, and AppRemover package version 4.3.113 or later.

Discoverer

Reported to OPSWAT via the OPSWAT Vulnerability Disclosure Program (VDP). Publicly indexed under CVE-2026-36425.