Improper Access Control in ArgusMonitor.sys

Executive Summary

CVE-2026-79417 is a local denial-of-service vulnerability in ArgusMonitor.sys affecting versions 7.4.02 and earlier. It involves improper access control where low-privileged users can exploit a TOCTOU condition in IRP_MJ_CREATE and send a crafted IOCTL request (0x9C4024A8) to bypass device handle restrictions. The flaw allows disabling CPU power-management via the WRMSR instruction targeting MSR 0xC0010015 (HWCR) on AMD systems, causing a system crash due to illegal MONITOR/MWAIT opcode execution in Hyper-V.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for the presence of ArgusMonitor.sys versions 7.4.02 or earlier. Inspect the driver file version and digital signature. Look for unusual IOCTL requests or WRMSR instruction usage in system logs. Monitor for system crashes with HYPERVISOR_ERROR 0x2001.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows low-privileged users to crash the system by disabling CPU power-management features. On systems running Hyper-V, it can trigger a bugcheck (HYPERVISOR_ERROR 0x2001), leading to a denial-of-service condition. Exploitation requires local access and crafting a specific IOCTL payload.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update ArgusMonitor to the latest patched version released on September 24, 2026. Remove or disable the vulnerable driver ArgusMonitor.sys if not required. Restrict access to the driver device object to prevent unauthorized IOCTL requests.

Useful 0 Not Useful 0