Critical WatchGuard Endpoint Security Flaw Exposes Kernel and Process Memory
CVE-2026-13043 lets local users bypass WatchGuard's PSKMAD driver checks and read kernel and process memory.
3
Stories per day · 30 days
2 RSS
9 stories, newest first · one card per story
Stories tagged #kernel-driver
CVE-2025-13032: Entering and Breaking the Avast Antivirus Sandbox Part 2
SafeTeam details full exploitation of CVE-2025-13032, a double-fetch bug in Avast's kernel driver, achieving kernel read/write and Windows 11 privilege escalation.
Fake LastPass on GitHub Led to an Infostealer That Killed 145 Security Tools
GitHub-based LastPass impersonation distributed 'Rapuncel' infostealer using a signed driver to kill 145 security tools.
3
Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer
Fake LastPass Authenticator GitHub repos spread new Rapuncel infostealer alongside a Microsoft-signed kernel driver that kills 145 antivirus and EDR products.
2
VU#687587: AOMEI Backupper amwrtdrv.sys local privilege escalation vulnerability allows arbitrary writes to physical disks
AOMEI Backupper 8.4.0 driver flaw CVE-2026-12780 lets unprivileged users write physical disks and execute UEFI code, bypassing HVCI and EDR.
2
Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot
Check Point revealed BTR Reforged, a technique weaponizing Microsoft Defender's built-in BTR.sys driver to delete security software at boot without exploiting any vulnerability.
Mustang Panda Upgrades CoolClient With a Kernel Rootkit
Mustang Panda's updated CoolClient backdoor deploys a signed kernel driver to hide processes, files and network activity in Asian intrusions.
4
Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth
Kaspersky reports Mustang Panda's updated CoolClient backdoor now deploys a signed kernel-mode Windows rootkit, hitting government victims in Myanmar, Mongolia, Pakistan, and Russia.
4
Heap overflow in kernel driver due to missing size validation
Fortinet fixes a CVSS 7.3 heap overflow in the FortiClient Windows kernel driver enabling code execution via crafted DNS responses.