Read the docs
TI-2025-00894 Aliases CVE-2025-1055GHSA-pmf4-2j7f-rq3c

Missing authorization in K7 Security Anti-Malware

Priority LOW 25CWE-862Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

A vulnerability in the K7RKScan.sys driver, part of the K7 Security Anti-Malware suite, allows a local low-privilege user to send crafted IOCTL requests to terminate a wide range of processes running with administrative or system-level privileges, with the exception of those inherently protected by the operating system. This flaw stems from missing access control in the driver's IOCTL handler, enabling unprivileged users to perform privileged actions in kernel space. Successful exploitation can lead to denial of service by disrupting critical services or privileged applications.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00236 14th percentileScored 2026-11-07
Fix Fixed K7 Security Anti-Malware (K7 Security): 23.0.0.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
K7 SecurityK7 Security Anti-Malwarebefore 23.0.0.1023.0.0.10Patch availableCNA
  • K7 Security Anti-Malware VendorK7 Security Affected before 23.0.0.10 Fixed in 23.0.0.10 Patch available CNA

Remediation

  • Fix · CNA K7 Security Anti-Malware (K7 Security) Fixed in 23.0.0.10

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-1055
  2. 2026-10-03 Alias added: GHSA-pmf4-2j7f-rq3c

References

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences