CVE-2026-15506: SecureAge CatchPulse Buffer Overflow

CVE-2026-15506 Overview

CVE-2026-15506 is a heap-based buffer overflow vulnerability in SecureAge CatchPulse up to version 10.9.3. The flaw resides in an unknown function within the saappctl.sys driver component. Local attackers with low privileges can trigger memory corruption to compromise confidentiality, integrity, and availability of the affected host. The vendor was notified prior to public disclosure and released version 10.10.0 to remediate the issue. Proof-of-concept exploit code has been published, increasing the risk of active exploitation against unpatched systems. The vulnerability is classified under CWE-119 for improper restriction of operations within the bounds of a memory buffer.

Critical Impact
A local, low-privileged attacker can trigger a heap-based buffer overflow in the CatchPulse kernel driver, potentially leading to code execution in kernel context and full system compromise.

Affected Products

SecureAge CatchPulse versions up to and including 10.9.3
Component: saappctl.sys kernel driver
Fixed in SecureAge CatchPulse 10.10.0

Discovery Timeline

2026-07-12 - CVE-2026-15506 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-15506

Vulnerability Analysis

The vulnerability exists in the saappctl.sys driver shipped with SecureAge CatchPulse endpoint protection software. An unspecified function within the driver fails to correctly validate the size of attacker-controlled input before writing to a heap-allocated buffer. This condition results in a heap-based buffer overflow when a local user interacts with the driver through its I/O control interface.

Because saappctl.sys runs in kernel mode, successful exploitation can corrupt adjacent kernel pool memory. Attackers can use the overflow to overwrite kernel structures, function pointers, or object headers. This provides a path from local user privileges to SYSTEM-level code execution on Windows hosts running the vulnerable driver.

The issue is tracked as [CWE-119] and affects all CatchPulse builds up to 10.9.3. Public exploit code has been released, and technical writeups describing the vulnerability chain are available through the referenced GitHub exploit repository and Jordan Higgins blog post.

Root Cause

The root cause is missing or insufficient bounds checking on user-supplied data passed to the saappctl.sys driver. A heap buffer is allocated based on assumed input constraints, but the driver copies data without enforcing the allocated buffer's true size. This mismatch permits an out-of-bounds write into kernel heap memory.

Attack Vector

Exploitation requires local access to a system with CatchPulse installed and low-level user privileges. The attacker opens a handle to the driver's device object and issues crafted I/O control (IOCTL) requests containing oversized or malformed input buffers. Since the driver exposes its interface to non-administrative callers, standard users can reach the vulnerable code path.

Detailed exploitation mechanics, including IOCTL codes and payload structure, are documented in the public proof-of-concept. Refer to the VulDB entry for CVE-2026-15506 for the full technical breakdown.

Detection Methods for CVE-2026-15506

Indicators of Compromise

Presence of saappctl.sys at a version corresponding to CatchPulse 10.9.3 or earlier on Windows endpoints
Unexpected process crashes or bugchecks referencing saappctl.sys in Windows crash dumps (MEMORY.DMP)
Non-administrative processes opening handles to the CatchPulse driver device object and issuing IOCTLs with unusually large input buffers
Execution of binaries or scripts matching artifacts from the published SecureAgeExploit repository

Detection Strategies

Inventory installed CatchPulse versions across the fleet and flag hosts running builds at or below 10.9.3
Monitor kernel crash telemetry for faults originating in saappctl.sys, which often indicate exploit attempts or instability
Alert on low-privileged processes performing DeviceIoControl calls against CatchPulse driver device objects
Hunt for post-exploitation activity such as new SYSTEM-level processes spawned shortly after CatchPulse driver interaction

Monitoring Recommendations

Enable Windows kernel auditing and forward Event Log data for driver load and crash events to a central analytics platform
Correlate EDR process telemetry with driver IOCTL activity to identify anomalous interactions with saappctl.sys
Track privilege escalations occurring on hosts with vulnerable CatchPulse builds installed
Ingest endpoint inventory data into a SIEM to maintain continuous visibility into patch compliance

How to Mitigate CVE-2026-15506

Immediate Actions Required

Upgrade SecureAge CatchPulse to version 10.10.0 or later on all endpoints without delay
Identify and prioritize multi-user systems, shared workstations, and terminal servers where local access is broadly available
Restrict interactive logon rights on hosts that cannot be patched immediately
Review recent kernel crash dumps referencing saappctl.sys for evidence of exploitation attempts

Patch Information

The vendor has released SecureAge CatchPulse 10.10.0, which remediates the heap-based buffer overflow in saappctl.sys. Upgrading to this build is the only supported fix. Consult the VulDB advisory and vendor release notes for deployment guidance.

Workarounds

If patching is not immediately possible, remove or disable the CatchPulse product on affected hosts until the update can be applied
Enforce least-privilege policies to limit which users can execute arbitrary binaries capable of invoking the driver
Apply application control policies to block execution of untrusted binaries, including known PoC artifacts referenced in the public exploit repository
Increase monitoring on affected endpoints and isolate any host exhibiting suspicious driver interactions pending remediation

bash

# Query installed CatchPulse version on Windows via PowerShell
Get-CimInstance -ClassName Win32_Product | Where-Object { $_.Name -like "*CatchPulse*" } | Select-Object Name, Version

# Check saappctl.sys file version
Get-Item "C:\Windows\System32\drivers\saappctl.sys" | Select-Object VersionInfo