CVE-2026-19193 in Jiangmin
Summary
by MITRE • 08/07/2026
A flaw has been found in Jiangmin Antivirus 21. Impacted is the function MessageNotifyCallback in the library kvcore.sys of the component Minifilter Port. Executing a manipulation can lead to improper access controls. The attack needs to be launched locally. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability resides within Jiangmin Antivirus 21's minifilter port component, specifically in the MessageNotifyCallback function located within the kvcore.sys library. This represents a critical access control flaw that stems from improper privilege handling within the kernel-mode driver interface. The affected system component operates at the core level of the operating system's file filtering mechanism, making it particularly dangerous as it directly interfaces with the kernel's minifilter framework. The vulnerability manifests when malicious input manipulation occurs during callback processing, potentially allowing unauthorized access to protected system resources.
This flaw constitutes a direct violation of proper access control mechanisms and aligns with CWE-284 which addresses improper access control vulnerabilities in software systems. The attack vector requires local execution, meaning an attacker must already have access to the target system to exploit this weakness, but the implications remain severe due to the kernel-level nature of the component. The minifilter port architecture is designed to intercept and process file system operations, making this vulnerability particularly concerning as it could allow privilege escalation or unauthorized data access. The fact that exploitation requires local execution does not diminish its severity since such vulnerabilities are often leveraged in combination with other attack techniques.
The operational impact of this vulnerability extends beyond simple access control violations, potentially enabling attackers to bypass security controls that protect against unauthorized file system modifications, data exfiltration, or system integrity compromise. Within the context of the ATT&CK framework, this vulnerability could be categorized under privilege escalation techniques and may facilitate lateral movement within a compromised system. The kernel-mode execution environment means that successful exploitation could result in complete system compromise without requiring additional attack vectors. The published exploit demonstrates that this vulnerability is not merely theoretical but actively being used by threat actors.
Security professionals should implement immediate mitigations including disabling or removing the vulnerable minifilter component from affected systems, applying available vendor patches if released, and monitoring for suspicious kernel-mode activity. System administrators must also consider implementing additional security controls such as driver signature enforcement and kernel-mode exploit prevention mechanisms. The lack of vendor response to prior disclosure indicates a potential delay in remediation efforts that may leave organizations vulnerable for extended periods. Organizations should also conduct thorough vulnerability assessments to identify other potentially affected components within their antivirus implementations and consider alternative security solutions while waiting for proper vendor fixes. The vulnerability highlights the importance of maintaining current security software versions and implementing proactive threat hunting measures to detect exploitation attempts.