patrickt2017/cve-2026-19193-pocCVE-2026-19193 Proof of Concept
Arbitrary Process Termination via Unauthenticated Minifilter Message Handler in Jiangmin Antivirus Kernel Driver (kvcore.sys)
Product: Jiangmin Antivirus V21
Component: kvcore.sys (Core Kernel Driver)
Version: 1.23.6.27
SHA-256 Hash: AE4ABB650C7DF1D3654AFC814617DE6F6589DC2C3BE434154B3BE0F6521E2259
High - 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
The Jiangmin Antivirus kernel driver, kvcore.sys exposes a minifilter communication port ("\KvCorePortX0") that accepts command messages from user-mode processes. The driver's MessageNotifyCallback (FUN_140008c60) dispatches a command code (0x1D / CMD_TERMINATE_PROCESS) to the function FUN_14000cf14, which terminates an arbitrary process specified by PID using the following kernel function chain:
The vulnerability exists because in FUN_14000688c, the filter communication port is created using FltBuildDefaultSecurityDescriptor() with an overly permissive access mask (0x1F0001), granting connection rights to EVERYONE (S-1-1-0). This allows any user-mode process to connect.
When a user-mode process sends a message to the KvCorePortX0 minifilter, the MessageNotifyCallback callback function (at FUN_140008c60) performs no caller authentication. There are no calls to SeSinglePrivilegeCheck(), PsGetCurrentProcess() validation, token verification, or any process allowlist check.
The PoC needs to run in an administrator command prompt and the kvcore.sys driver must be running
sc.exe create kvcore type= kernel binPath= <driver-path> ; sc.exe start kvcore)Example:
.\kvcore_kill_poc.exe --name "MsMpEng.exe"
.\kvcore_kill_poc.exe --pid 3340
Test result in Windows 11 24H2 (Build 26200):
