CVE-2026-19193
Received Received - Intake

Improper Access Control in Jiangmin Antivirus via Minifilter Port

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: VulDB

Description
A flaw has been found in Jiangmin Antivirus 21. Impacted is the function MessageNotifyCallback in the library kvcore.sys of the component Minifilter Port. Executing a manipulation can lead to improper access controls. The attack needs to be launched locally. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-19193
EUVD
EUVD-2026-54359

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
jiangmin antivirus 21
jiangmin antivirus From 1.23.6.27 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-19193 is a high-severity flaw in Jiangmin Antivirus 21. It affects the kernel driver kvcore.sys, specifically the MessageNotifyCallback function in the Minifilter Port component. The vulnerability allows improper access controls due to overly permissive port access rights, enabling local attackers to terminate arbitrary processes via crafted messages without authentication.

Detection Guidance

Check for the presence of the vulnerable kvcore.sys driver version 1.23.6.27 in Jiangmin Antivirus installations. Look for the exposed minifilter port named "\KvCorePortX0" using tools like WinObj or fltmc. Monitor for unauthorized process terminations or unusual activity targeting security software.

Impact Analysis

This vulnerability allows local attackers to terminate any process on the system, including security software like Windows Defender. Attackers can exploit it by sending crafted messages to the exposed port, potentially disrupting system operations or disabling protection mechanisms. Proof-of-concept code exists, making exploitation feasible.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized process termination, potentially disrupting security software or critical system processes. Unauthorized termination of processes may lead to data integrity issues or system unavailability, violating requirements for data protection and availability in these regulations.

Mitigation Strategies

Uninstall or update Jiangmin Antivirus to a patched version. Disable the vulnerable driver kvcore.sys if possible. Restrict access to the minifilter port "\KvCorePortX0" and monitor for suspicious process termination attempts. Apply principle of least privilege to user accounts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19193. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart