Preface: Safetica is a Data Loss Prevention (DLP) and Insider Risk Management (IRM) solution that stops data breaches and protects companies from insider threats.

Safetica was recognized as a “Trail Blazer” in the 2025 Data Loss Prevention Market Quadrant, indicating its growing influence and innovative, best-of-breed technology.

Safetica consistently ranks as a leader in G2’s Fall 2025 Reports, with numerous badges for Data Loss Prevention, User and Entity Behavior Analytics (UEBA), and Insider Threat Management.

Background: What is the missing piece in Safetica’s vulnerable driver—and what should be added to make this IOCTL handler secure—is proper access validation for the caller’s privileges.

The Missing Function: IoValidateDeviceIoControlAccess

This function ensures that the caller has the required access rights (e.g., FILE_READ_DATA, FILE_WRITE_DATA) before processing the IOCTL request. Without this check, any unprivileged user can send IOCTLs to the driver and trigger privileged operations.

Reference:

When creating a device object in the driver, you should use:

• IoCreateDeviceSecure and specify SDDL (Security Descriptor Definition Language). This prevents unauthorized, low-privilege programs from arbitrarily calling your DeviceIoControl.
• IoValidateDeviceIoControlAccess enforces the security descriptor you set with IoCreateDeviceSecure and SDDL, ensuring only authorized callers can execute privileged operations.

Vulnerability details: A vulnerabilty has been discovered in Safetica’s ProcessMonitorDriver.sys kernel driver. A local, unprivileged user can abuse a vulnerable IOCTL (Input/Output Control) path in the kernel driver to cause privileged termination of arbitrary system processes. IOCTL interfaces allow user-mode software to send commands into the kernel space so that the driver can perform specific privileged actions such as terminating processes. Terminating Safetica’s processes in endpoint detection and response and antivirus software can blind their clients’ security monitoring on their machines. Improper input sanitization and user validation mechanisms can manipulate the kernel driver into privilege escalation and DOS (denial of service).

Official announcement: Please refer to the link for details –

https://www.tenable.com/cve/CVE-2026-0828https://kb.cert.org/vuls/id/818729