CVE-2026-97732: Medium severity IRONMACE Ironshield vulnerability
IRONMACE Ironshield 1.0.0.167 has a tvk.sys kernel-mode driver that authenticates client executables by checking for expected publisher and root-certificate strings in WINCERTIFICATE data ("IRONMACE Co., Ltd." and "DigiCert Trusted Root G4") instead of parsing and validating the PKCS signature data. As a result, a local unprivileged attacker may bypass this via crafted certificate data and obtain access to privileged IOCTL functionality.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems with IRONMACE Ironshield 1.0.0.167 and its tvk.sys kernel-mode driver installed are exposed. Exploitation requires local access, but the attacker does not need prior privileges or user interaction.
What does an attacker need to exploit it?
An attacker needs to run a client executable locally and provide crafted WIN_CERTIFICATE data containing the expected publisher and root-certificate strings. The driver checks those strings rather than parsing and validating the PKCS signature data.
What access could exploitation provide?
A successful bypass can give an unprivileged local attacker access to privileged IOCTL functionality exposed by the kernel-mode driver.