Skip to content
CVE PROGRAM SOURCE RECORD5.1 Medium

CVE-2026-97732

IRONMACE Ironshield 1.0.0.167 has a tvk.sys kernel-mode driver that authenticates client executables by checking for expected publisher and root-certificate strings in WIN_CERTIFIC

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mitre

Description

IRONMACE Ironshield 1.0.0.167 has a tvk.sys kernel-mode driver that authenticates client executables by checking for expected publisher and root-certificate strings in WIN_CERTIFICATE data ("IRONMACE Co., Ltd." and "DigiCert Trusted Root G4") instead of parsing and validating the PKCS signature data. As a result, a local unprivileged attacker may bypass this via crafted certificate data and obtain access to privileged IOCTL functionality.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

IRONMACE Ironshield

Default version status: unknown

  • 1.0.0.167affected

References