TI-2026-64271 Aliases CVE-2026-97732 GHSA-xmqc-9f27-v5xv

Improper signature verification in IRONMACE Ironshield

LOW 22CWE-347Published 2026-09-25 · Updated 2026-09-25

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-347.

Summary

IRONMACE Ironshield 1.0.0.167 has a tvk.sys kernel-mode driver that authenticates client executables by checking for expected publisher and root-certificate strings in WIN_CERTIFICATE data ("IRONMACE Co., Ltd." and "DigiCert Trusted Root G4") instead of parsing and validating the PKCS signature data. As a result, a local unprivileged attacker may bypass this via crafted certificate data and obtain access to privileged IOCTL functionality.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00056 0th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
IRONMACE	Ironshield	1.0.0.167	—	No fix listed	CNA

Ironshield VendorIRONMACE Affected 1.0.0.167 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-97732
2026-10-03 Alias added: GHSA-xmqc-9f27-v5xv

References

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences