CatchPulse Antivirus 0day Vulns (CVE-2026-11459/460): Driver Arbitrary File Read & Heap Overflow RCE Analysis

Vulnerability Overview The webpage describes two zero-day vulnerabilities in CatchPulse Antivirus (affecting versions up to 10.9.3), identified as CVE-2026-11459 and CVE-2026-11460. These vulnerabilities allow attackers to perform unauthorized file reads and heap overflows via a driver, thereby obtaining sensitive system information and executing arbitrary code. Impact Scope CatchPulse Antivirus: All versions up to 10.9.3. System Privileges: Attackers can leverage these vulnerabilities to run with administrative privileges, thereby accessing and modifying system files. Remediation Update Software: Users are advised to immediately update CatchPulse Antivirus to the latest version to patch known security vulnerabilities. Restrict Driver Permissions: Developers should re-evaluate and restrict the driver's file access permissions, ensuring that only necessary processes can access sensitive files. Strengthen Input Validation: Add validation for the length and format of input data within the driver to prevent attacks such as heap overflows. POC Code Vulnerability 1: Arbitrary File Read (CVE-2026-11459) Vulnerability 2: Heap Overflow Detailed Analysis 1. Improper Use of IOCreateDevice: - The driver does not correctly restrict the creation of file handles, allowing any process to acquire a file handle. - By modifying the PEB (Process Environment Block), attackers can bypass process authorization checks. 2. Driver Functionality: - The driver allows reading system files, including the SAM and SYSTEM registry hives, which contain sensitive information. - Attackers can read the content of arbitrary files via the function. 3. Bypassing Process Authorization: - By modifying the command-line arguments in the PEB, attackers can masquerade as legitimate processes to bypass security restrictions. 4. Exploitation Methods: - Arbitrary File Read: Sensitive files, such as password hashes, are read via the driver. - Heap Overflow: A heap overflow is triggered by sending overly long data, allowing the execution of arbitrary code. Conclusion These vulnerabilities severely impact system security, enabling attackers to gain control of the system. Users are strongly advised to update the software as soon as possible and implement the aforementioned remediation measures.

Goal Reached Thanks to every supporter — we hit 100%!

CatchPulse Antivirus 0day Vulns (CVE-2026-11459/460): Driver Arbitrary File Read & Heap Overflow RCE Analysis