CVE-2026-38053---Remove-PPL

BYOVD Remove PPL for 24H2 and 25H2

An arbitrary memory write in the handler for IOCTL 0x12C807 (METHOD_NEITHER) of Wise System Monitor v1.5.3.127 allows attackers to cause a remove PPL or Denial of Service (DoS) via a crafted input.

---

[Additional Information]

• Tested on: Windows 11 25H2. Likely affects all Windows versions on which the vulnerable driver version is installed.
• EPROCESS.Protection offset used in PoC: +0x87A (Windows 11 25H2). Offset may vary across Windows builds.
• EPROCESS.SignatureLevel offset: +0x878, SectionSignatureLevel: +0x879 " also zeroed by the exploit.

A proof-of-concept exploit demonstrating PPL removal on lsass.exe (Windows 11 25H2) has been developed.

---

[VulnerabilityType Other]

Arbitrary memory write

---

[Vendor of Product]

WiseCleaner (WiseCleaner.com)

---

[Affected Product Code Base]

Wise System Monitor (specifically the driver WiseTDIFw64.sys) - 1.5.3.127 (driver version: 1.1.4.36)

---

[Affected Component]

WiseTDI Firewall kernel driver: WiseTDIFw64.sys version 1.1.4.36

---

[Attack Type]

Local

---

[CVE Impact Other]

A local administrator can bypass Windows Protected Process Light (PPL) on lsass.exe by exploiting an arbitrary kernel memory write primitive in the driver. This allows full read/write access to LSASS process memory, enabling credential dumping (e.g., via Mimikatz). Integrity of credential isolation on affected systems is fully compromised.

---

[Attack Vectors]

Local. The attacker must have Administrator-level privileges on the target machine to open a handle to the device (\.\WiseTdiFw) and issue IOCTLs. No network access or user interaction is required beyond this.

---

[Reference]

https://www.wisecleaner.com/