Executive Summary

CVE-2025-68947 is a vulnerability in the NSecsoft 'NSecKrnl' Windows driver that allows a local, authenticated attacker to terminate processes owned by other users, including SYSTEM and Protected Processes. The attacker issues specially crafted IOCTL requests to the driver, which then uses kernel functions to locate and terminate targeted processes. This vulnerability is exploited in a malicious campaign by ValleyRAT using a Bring Your Own Vulnerable Driver (BYOVD) technique, where a signed but vulnerable driver is loaded from a user-writable temporary directory. The driver listens for commands to terminate specific security-related processes, enabling attackers to disable endpoint security products persistently. [1, 2]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to disable security software on affected systems by terminating their processes, including antivirus and endpoint protection services. This can lead to a compromised system where malware or remote access trojans (RATs) can operate undetected, increasing the risk of data theft, system control loss, and further exploitation. The persistent termination of security processes makes detection and remediation more difficult, potentially allowing attackers to maintain long-term access. [1, 2]

Useful 0 Not Useful 0