CVE-2026-19195 - Proof of Concept

Arbitrary Registry Key Modifications via Unauthenticated IOCTL requests in Jingyun Antivirus Kernel Driver (ZyArk.sys)

Affected Asset

Product: Jingyun Antivirus

Version: 2.4.2.39

Component: ZyArk.sys

SHA-256 Hash: E89927434EA9297D2845F107441F5E3D5337457E7B844FF4AF3755369E9E7C4E

Severity

High - 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Description of the Vulnerability

Jingyun Antivirus kernel driver ZyArk.sys exposes an arbitrary registry key manipulation through IOCTL with insufficient access controls. The driver creates its device object with a security descriptor granting everyone full access. The IOCTL handler 0x226AF0 dispatches to FUN_0001b32c, which performs kernel-mode registry operations (ZwCreateKey, ZwOpenKey, ZwSetValueKey, ZwDeleteKey, etc.) as SYSTEM without any caller authentication. This allows low-privileged standard users to read, write, and delete any registry key on the system. In this example, Windows Defender can be completely disabled by registry manipulations.

Proof of Concept/Step to Reproduce

Run the exploit in a low-privileged standard prompt with the ZyArk.sys kernel service:

• either Jingyun Antivirus running or
• Use sc.exe to manually create a kernel service (sc.exe create ZyArk type= kernel binPath= ; sc.exe start ZyArk)

Mitigations and Recommendations

1. Repair Device SDDL: Grant access only to SYSTEM and built-in administrators.

2. Verify the calling process before processing any IOCTL: Verify the caller's PID against the allowed list, and verify the caller's digital signature.