CVE-2025-52915: K7 Security Anti-Malware DoS Vulnerability

CVE-2025-52915 Overview

CVE-2025-52915 affects K7RKScan.sys version 23.0.0.10, a kernel driver shipped with the K7 Security Anti-Malware suite. The driver's IOCTL handler performs insufficient caller validation, allowing an admin-privileged user to issue crafted IOCTL requests that terminate processes protected by third-party protection mechanisms. The flaw is classified under [CWE-269] Improper Privilege Management. Successful exploitation produces denial of service by disrupting critical third-party services or security applications running on the host. K7 Computing published an advisory on September 2, 2025, addressing the issue.

Critical Impact
An attacker with administrative privileges can abuse the signed K7RKScan driver to terminate protected processes in kernel space, disabling security tooling and creating a denial-of-service condition.

Affected Products

K7 Security Anti-Malware suite
K7RKScan.sys driver version 23.0.0.10
Endpoints running vulnerable K7 Computing products prior to the September 2, 2025 advisory fix

Discovery Timeline

2025-09-02 - K7 Computing publishes security advisory addressing the issue
2025-09-09 - CVE-2025-52915 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-52915

Vulnerability Analysis

The vulnerability resides in the IOCTL handler of K7RKScan.sys, a kernel-mode driver delivered with K7 Security Anti-Malware. The driver exposes a device interface that accepts I/O control codes from user mode. When the handler processes a request to terminate a process, it does not adequately validate the calling context or the legitimacy of the caller. This allows any process running with administrative privileges to invoke kernel-level process termination logic, including against processes that are otherwise protected by third-party self-protection schemes such as Protected Process Light or vendor-specific guardrails. Because the action originates from a signed kernel driver, it bypasses user-mode restrictions enforced on the targeted application.

Root Cause

The root cause is improper privilege management [CWE-269] inside the driver's dispatch routine. The handler treats any caller possessing the correct device handle and IOCTL code as authorized to request privileged termination operations. The driver fails to validate whether the caller should be allowed to terminate the specified target, and it does not enforce a least-privilege boundary between admin user-mode callers and kernel-mediated actions.

Attack Vector

Exploitation requires an attacker who already holds administrative privileges on the host. The attacker opens a handle to the K7RKScan device object and issues a crafted DeviceIoControl call containing the target process identifier. The driver executes the termination in kernel context, killing third-party security or business-critical processes that would normally be shielded from admin-level termination. The vulnerability is consistent with the bring-your-own-vulnerable-driver (BYOVD) class of abuse, where a legitimately signed driver becomes a primitive for disabling defenses. Technical details are documented in the K7 Computing Security Advisory.

Detection Methods for CVE-2025-52915

Indicators of Compromise

Unexpected loading of K7RKScan.sys version 23.0.0.10 on systems that do not run K7 Security products
Process termination events targeting endpoint protection, EDR, or backup agents without a corresponding user-initiated stop command
CreateFile handles opened to the K7RKScan device object from non-K7 binaries
Sudden service crashes or restarts of third-party security software followed by absence of telemetry

Detection Strategies

Hunt for the K7RKScan.sys driver hash and version 23.0.0.10 across the fleet, especially on hosts where K7 products are not authorized
Monitor kernel image loads and correlate driver load events with subsequent abnormal process exits of protected services
Alert on DeviceIoControl activity from unsigned or unexpected processes against K7 device objects

Monitoring Recommendations

Enable Windows Defender Application Control or WDAC driver block rules to inventory vulnerable driver versions
Stream Sysmon Event ID 6 (driver loaded) and Event ID 5 (process terminated) to a central data lake for correlation
Track parent-child relationships where administrative tools spawn processes that open handles to security-related kernel devices

How to Mitigate CVE-2025-52915

Immediate Actions Required

Update K7 Security Anti-Malware to the version released in the K7 Computing advisory dated September 2, 2025
Inventory all endpoints for the vulnerable K7RKScan.sys 23.0.0.10 driver and remove or replace it
Restrict local administrator rights on workstations and servers to limit the population of users who can abuse the driver
Add the vulnerable driver hash to Microsoft's recommended driver block list or an equivalent WDAC policy

Patch Information

K7 Computing has issued a fixed build referenced in the K7 Computing Security Advisory. Administrators should apply the updated K7 Security Anti-Malware package through the standard product update channel. Confirm that the post-update driver version is greater than 23.0.0.10 and that the old driver file is no longer present on disk.

Workarounds

Uninstall K7 Security Anti-Malware on hosts where patching cannot be performed immediately
Enable Microsoft's vulnerable driver blocklist via Windows Security to prevent loading of the affected K7RKScan.sys build
Enforce least privilege so that day-to-day accounts do not hold local administrator rights required to invoke the IOCTL

bash

# Configuration example: enable Microsoft vulnerable driver blocklist on Windows
reg add "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config" /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 1 /f