Kernel-mode Driver Vulnerability in Ironshield by IRONMACE
CVE-2026-97732

5.1MEDIUM

Key Information:

Vendor

Ironmace

Status
Ironshield
Vendor
CVE Published:
25 September 2026

What is CVE-2026-97732?

The Ironshield 1.0.0.167 by IRONMACE features a kernel-mode driver (tvk.sys) that incorrectly authenticates client executables. Instead of properly validating the PKCS signature data, it checks for specific publisher and root-certificate strings in WIN_CERTIFICATE data, which could allow a local unprivileged attacker to craft malicious certificate data. This weakness can lead to unauthorized access to sensitive privileged IOCTL functionalities, posing serious security implications.

Affected Version(s)

Ironshield Windows 1.0.0.167

References

https://github.com/hseoa/ironshield-analysis
https://store.steampowered.com/eula/2016590_eula_0

CVSS V3.1

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.