CVE-2026-8501 Details

A vulnerability in the PCTCore64.sys Windows kernel driver from PC Tools Internet Security allows improper access control, enabling user-mode processes to interact with the PCTCoreDriver WDM device interface and execute privileged IOCTL handlers. This issue arises because the driver does not implement a secure access control policy, leaving the device interface exposed to unprivileged processes. As a result, a local attacker with the ability to load the affected driver can exploit this vulnerability to perform sensitive operations, such as accessing credentials from lsass.exe or terminating protected processes.

Organizations are advised to remove the vulnerable PCTCore64.sys driver and block its use. Microsoft recommends applying the latest vulnerable driver blocklist through App Control for Business, which can be downloaded from the Microsoft Download Center. Additionally, enabling Hypervisor-Protected Code Integrity (HVCI) and Windows Defender Application Control (WDAC) can provide further protection.