Skip to content
Heist/ feed
Medium

CVE-2026-97732

Type: advisorySource: Official CVE List1 source record

IRONMACE Ironshield 1.0.0.167 has a tvk.sys kernel-mode driver that authenticates client executables by checking for expected publisher and root-certificate strings in WIN_CERTIFICATE data ("IRONMACE Co., Ltd." and "DigiCert Trusted Root G4") instead of parsing and validating the PKCS signature data. As a result, a local unprivileged attacker may bypass this via crafted certificate data and obtain access to privileged IOCTL functionality.

Announced Source revision 1
Original source ↗

CVE-2026-97732

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-97732

Ironshield

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "IRONMACE",
    "modules": [
      "tvk.sys kernel-mode driver"
    ],
    "product": "Ironshield",
    "versions": [
      {
        "status": "affected",
        "version": "1.0.0.167",
        "versionType": "custom"
      }
    ],
    "platforms": [
      "Windows"
    ],
    "defaultStatus": "unknown"
  }
]
Related CVEs
CVE-2026-97732

Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event
#2085 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement