Description

A flaw has been found in Yungengxin Yun Jia Security Guard up to 2.7.1.9. Impacted is the function sub_14000885C in the library kgameprotect.sys. Executing a manipulation of the argument Pid can lead to improper privilege management. The attack requires local access. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.4",
  "pubDate": "2026-10-12T13:17:27.280Z",
  "pubdate": "2026-10-12T13:17:27.280Z",
  "executiveSummary": "A vulnerability has been identified in Yungengxin Yun Jia Security Guard up to version 2.7.1.9, involving improper privilege management within the kernel-mode driver kgameprotect.sys.\nThe flaw resides specifically in function sub_14000885C, where insufficient validation of the Pid (Process Identifier) argument allows a local attacker to manipulate system processes.\nThis vulnerability poses a significant security risk, as successful exploitation enables local privilege escalation, potentially granting an attacker higher execution context than intended.\nThe impact is restricted to local access, requiring the attacker to have established a presence on the host system to interact with the vulnerable driver.\nThe vendor failed to respond to disclosure attempts, leaving affected systems without an official security patch.\nSystem administrators should prioritize mitigating this risk by monitoring system calls or restricting access to the vulnerable kernel module if possible.",
  "technicalDetails": "The vulnerability is situated within the kernel-mode driver 'kgameprotect.sys', which is part of the Yungengxin Yun Jia Security Guard software suite. The root cause of this security flaw is an improper validation mechanism within the function 'sub_14000885C' regarding the handling of a user-supplied 'Pid' argument.\nIn Windows kernel driver development, functions that accept a Process Identifier (Pid) from user mode must strictly validate the authenticity and permissions associated with the target process. The function 'sub_14000885C' fails to perform adequate bounds or privilege checks on this input before performing operations, effectively acting as an interface that permits unauthorized process interaction.\nThe attack flow begins when an attacker, possessing local user-level access, opens a handle to the 'kgameprotect.sys' device object. Once the communication channel is established, the attacker sends a crafted IOCTL (I/O Control) request to the driver. This request contains a manipulated 'Pid' value designated for the 'sub_14000885C' routine.\nBecause the function fails to sanitize or verify the ownership of the provided 'Pid', it proceeds to execute privileged operations under the authority of the kernel driver on behalf of the manipulated process identifier. If the attacker targets a high-privilege system process (such as SYSTEM) or manipulates the driver to perform actions on a target process to inject code or alter memory, they can achieve privilege escalation.\nThis vulnerability is classified as improper privilege management because the driver acts as a confused deputy, using its kernel-level privileges to perform operations requested by an unprivileged user without checking if that user has the rights to perform those operations on the specified 'Pid'. The exploit requires local execution capability on the target host; there is no remote network attack vector identified. Post-exploitation, an attacker could gain elevated SYSTEM permissions, disable security software components, or maintain persistence on the compromised machine.\nAffected versions of the product include all iterations up to and including 2.7.1.9. Given the nature of the flaw in the kernel driver, the exploitation is highly reliable once the IOCTL interface is correctly identified and mapped by the attacker."
}