CVE-2026-3796
📋 TL;DR
This vulnerability in Qi-ANXIN QAX Virus Removal allows local attackers to bypass access controls through improper handling in the ZwTerminateProcess function. Attackers with local access can exploit this to terminate processes they shouldn't have permission to access. Only users of Qi-ANXIN QAX Virus Removal up to October 22, 2025 are affected.
💻 Affected Systems
- Qi-ANXIN QAX Virus Removal
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation allowing attackers to terminate critical system processes, potentially causing system instability or facilitating further attacks.
Likely Case
Local users can terminate processes they shouldn't have access to, potentially disrupting antivirus protection or other security software.
If Mitigated
With proper access controls and monitoring, impact is limited to process termination without privilege escalation.
🎯 Exploit Status
Exploit code is publicly available on GitHub as 'FocusKiller'. Attack requires local execution privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available - vendor did not respond to disclosure
Restart Required: No
Instructions:
No official patch available. Consider alternative antivirus solutions or implement workarounds.
🔧 Temporary Workarounds
Disable or remove vulnerable driver
windowsPrevent loading of the vulnerable QKSecureIO_Imp.sys driver
sc stop QKSecureIO
sc delete QKSecureIO
Uninstall vulnerable software
windowsRemove Qi-ANXIN QAX Virus Removal completely
Control Panel > Programs > Uninstall a program > Select Qi-ANXIN QAX Virus Removal
🧯 If You Can't Patch
- Implement strict local access controls and monitor for suspicious process termination attempts
- Deploy application whitelisting to prevent unauthorized execution of exploit tools
🔍 How to Verify
Check if Vulnerable:
Check if QKSecureIO_Imp.sys driver is loaded: Open Device Manager > View > Show hidden devices > Look for QKSecureIO driverCheck Version:
Check program version in Control Panel > Programs > Qi-ANXIN QAX Virus Removal propertiesVerify Fix Applied:
Verify driver is not loaded and Qi-ANXIN software version is newer than 2025-10-22📡 Detection & Monitoring
Log Indicators:
- Unexpected process termination events
- Access denied errors for process termination attempts
- Driver loading/unloading events for QKSecureIO
Network Indicators:
- None - local-only vulnerability
SIEM Query:
EventID=4689 OR EventID=4656 with process name containing 'ZwTerminateProcess' or driver name 'QKSecureIO'