CVE-2026-36425
Published Jul 16, 2026
Description
An issue in OPSWAT AppRemover Driver (ardrv.sys) v2017.10.02.1551 and earlier in IOCTL handler 0x2420031. Any local user can open the device and send process termination requests without privilege validation.
Is your site exposed to CVE-2026-36425?
Run a free security scan — no signup, results in seconds.
References
Other References
https://github.com/redteamfortress/CVE-2026-36425
https://www.opswat.com/products/oesis-framework/application-removal
https://www.virustotal.com/gui/file/07c5209bf83065fe760f4fee4ed2308b0c523671f68ca73a3854c2c8c28c0541
https://www.virustotal.com/gui/file/2248347b2ec49f07268a44816ebb6265677093ec277f825de1a76700ab25e3bc
Frequently Asked Questions
What is CVE-2026-36425? +
An issue in OPSWAT AppRemover Driver (ardrv.sys) v2017.10.02.1551 and earlier in IOCTL handler 0x2420031. Any local user can open the device and send process termination requests without privilege validation.
How do I check if I'm vulnerable to CVE-2026-36425? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.