TI-2021-11763 Aliases CVE-2021-31728 GHSA-hgc8-6w6r-m2w8

Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150…

MEDIUM 40Published 2021-05-17 · Updated 2024-08-03

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 allows a non-privileged process to open a handle to \.\ZemanaAntiMalware, register itself with the driver by sending IOCTL 0x80002010, allocate executable memory using a flaw in IOCTL 0x80002040, install a hook with IOCTL 0x80002044 and execute the executable memory using this hook with IOCTL 0x80002014 or 0x80002018, this exposes ring 0 code execution in the context of the driver allowing the non-privileged process to elevate privileges.

Why it matters now

EPSS 0.03399 88th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:malwarefox:antimalware:2.74.0.150:::::::*	2.74.0.150	Vulnerable	Malwarefox

cpe:2.3:a:malwarefox:antimalware:2.74.0.150:*:*:*:*:*:*:* Versions 2.74.0.150 Vulnerable ·Malwarefox

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2021-31728
2026-10-03 Alias added: GHSA-hgc8-6w6r-m2w8

References

Advisory 1

https://github.com/irql0/CVE-2021-31728/blob/master/CVE-2021-31728.md

TI-2018-04869 An issue was discovered in MalwareFox AntiMalware 2.74.0.150. CVSS 3.0HIGH 7.8
TI-2018-04860 An issue was discovered in MalwareFox AntiMalware 2.74.0.150. CVSS 3.0HIGH 7.8
TI-2021-11762 Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150… CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences