| Title | V-Secure Technology Jingyun Antivirus 2.4.2.39 Exposed IOCTL with Insufficient Access Control |
|---|
| Description | Jingyun Antivirus v2.4.2.39 exposes an arbitrary registry key manipulation through IOCTL with insufficient access controls. The driver creates its device object with a security descriptor granting everyone full access. The IOCTL handler 0x226AF0 dispatches to FUN_0001b32c, which performs kernel-mode registry operations (ZwCreateKey, ZwOpenKey, ZwSetValueKey, ZwDeleteKey, etc.) as SYSTEM without any caller authentication. This allows any user — including low-privileged standard users — to read, write, and delete any registry key on the system, bypassing all Windows ACL protections.
The most critical impact of this vulnerability is the ability to disable Windows Defender through the GPO policy registry paths below. Any user can create this key (HKLM\SOFTWARE\Policies\Microsoft\Windows Defender) and set the following values to 1 via the ZyArk.sys registry IOCTL:
- DisableAntiSpyware
- DisableAntiVirus
- Real-Time Protection\DisableRealtimeMonitoring
- Real-Time Protection\DisableBehaviorMonitoring
After restarting, Windows Defender enters "policy disabled" mode—MsMpEng.exe continues to run, but all scanning and protection functions are disabled. The device is completely exposed to malware threats. |
|---|
| Source | ⚠️ https://github.com/patrickt2017/research/issues/2 |
|---|
| User | patrickt2017 (UID 97401) |
|---|
| Submission | 06/20/2026 20:55 (2 months ago) |
|---|
| Moderation | 08/06/2026 22:09 (2 months later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 386712 [V-Secure Jingyun Antivirus 2.4.2.39 Kernel Driver ZyArk.sys access control] |
|---|
| Points | 20 |
|---|