CVE-2026-8501: CVE-2026-8501

Synopsis

Improper access control in the PCTCore64.sys kernel driver shipped with PC Tools Internet Security (a Symantec product) lets any local user-mode process open the PCTCoreDriver WDM device interface and call privileged IOCTL handlers that should be restricted to trusted callers. The vulnerability is reached locally and requires only a low-privilege account, with no user interaction needed. Successful exploitation gives an attacker full read, write, and availability control over the host, effectively enabling privilege escalation to kernel-level operations. No fix version has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no administrative or elevated credentials are needed to reach the vulnerable IOCTL interface.

• Victim interactionNot required

  No user interaction is required; the attacker can invoke the vulnerable IOCTL handlers entirely through their own process.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no race-condition, memory-layout, or other environmental prerequisites.

Blast Radius

• A successful attacker reads sensitive kernel-level and process memory, including credentials, tokens, and security policy data held by the driver.
• The attacker writes to privileged kernel structures or invokes IOCTL handlers to modify security configurations, disable protections, or alter system state.
• The attacker can crash or destabilize the host by misusing privileged driver operations, causing a denial of service to all workloads on the machine.
• Because exploitation reaches kernel privilege, the attacker can undermine any user-mode or kernel-mode security control running on the same host.