CVE-2026-19195 in Jingyun Antivirus
Summary
by MITRE • 08/07/2026
A vulnerability has been found in V-Secure Jingyun Antivirus 2.4.2.39. The affected element is an unknown function in the library ZyArk.sys of the component Kernel Driver. The manipulation leads to improper access controls. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
This vulnerability resides within the kernel driver component ZyArk.sys of V-Secure Jingyun Antivirus version 2.4.2.39, representing a critical access control flaw that fundamentally compromises system security. The affected function within this kernel-level library demonstrates improper privilege handling that allows local attackers to bypass intended security boundaries. This type of vulnerability directly maps to CWE-284 which describes improper access control in software systems where entities lack proper authorization to perform actions or access resources. The kernel driver nature of this component means that any successful exploitation would grant attacker elevated privileges at the operating system level, potentially enabling complete system compromise.
The technical implementation flaw manifests through an unknown function within ZyArk.sys that fails to properly validate access permissions or implement adequate security checks for kernel-level operations. This deficiency creates a pathway for local users to manipulate the driver's behavior and gain unauthorized access to protected system resources. The vulnerability's classification as a local attack vector indicates that exploitation does not require network connectivity or remote access, making it particularly dangerous since any user with local system access could potentially leverage this flaw. The fact that this exploit has been publicly disclosed and is considered usable by threat actors significantly elevates the risk profile of affected systems.
Operational impact assessment reveals severe consequences for organizations running vulnerable versions of this antivirus software. Local privilege escalation vulnerabilities in kernel drivers provide attackers with unprecedented control over target systems, enabling them to modify system files, install malware, access sensitive data, or establish persistent backdoors. The vulnerability's presence in an antivirus solution creates a particularly concerning scenario where the security tool itself becomes a potential attack vector rather than a protective barrier. Organizations may experience complete system compromise, data breaches, and potential lateral movement within networks where vulnerable systems exist.
Mitigation strategies must prioritize immediate remediation through vendor-provided updates or patches addressing the specific kernel driver vulnerability in ZyArk.sys. System administrators should implement strict access controls limiting local user privileges and monitor for suspicious kernel-level activity that might indicate exploitation attempts. The ATT&CK framework's T1068 technique for exploit for privilege escalation is particularly relevant here, as attackers may leverage this vulnerability to gain administrative privileges through kernel-level manipulation. Organizations lacking vendor response should consider alternative security solutions or implement additional protective measures including endpoint detection and response tools to monitor for exploitation indicators. Regular system audits and vulnerability assessments should specifically target kernel drivers and privileged components to identify similar access control weaknesses that could be exploited by adversaries.