CVE-2026-36425 : OPSWAT AppRemover Arbitrary Process Termination

A signed OPSWAT kernel driver that kills any process on demand. No admin rights needed, no privilege checks, no questions asked. Point it at an EDR, an antivirus, a PPL-protected process and it dies. Three different kill methods, all running from kernel mode, all triggered by a single IOCTL from any local user. 16 vulnerable driver variants identified, all validly signed.

⚠️ This repository is for educational and research purposes only. The author is not responsible for any misuse of the information or tools provided.

📝 Blog Post: Introducing CVE-2026-36425 | OPSWAT EDR Terminator

In the blog post we walk through the full reverse engineering process of the driver in IDA Pro, from the DriverEntry setup to the IOCTL dispatch chain, and break down the three different process termination methods the driver uses under the hood. We also demonstrate a live test against one of the famous EDR, loading the signed driver and terminating the agent from kernel mode.

Overview

Description

The OPSWAT AppRemover kernel driver (ardrv.sys) exposes a device object (\\.\ardrv) that is accessible to any local user without privilege validation. The driver's IOCTL handler 0x2420031 performs process termination on a caller-supplied PID using three distinct methods:

1. Memory corruption : attaches to the target process via KeAttachProcess and overwrites the first 4096 pages with 0xCC (INT3 breakpoints), forcing a crash.
2. Direct termination : opens the process via ObOpenObjectByPointer and calls ZwTerminateProcess for high PID values.
3. Job object termination : creates a Job Object, assigns the target process to it, and terminates the entire job via ZwTerminateJobObject as a fallback.

All three methods execute in kernel context with no caller validation, no privilege checks, and no protection for critical or PPL processes. This can be abused to terminate EDR/AV agents and other security software.

Usage

ardrvkiller.exe <PID>

Load the driver

sc.exe create ardrv binPath="C:\path\to\ardrv_XX.sys" type=kernel
sc.exe start ardrv

Kill a process

ardrvkiller.exe 1234

Vulnerable Driver Variants

16 variants identified, all signed by OPSWAT, all sharing the same vulnerability.

Timeline

References

• CVE Record
• NVD
• Blog Post

author

j3h4ck @j3h4ck | linkedin | medium