Driver intelligenceVulnerableVerified

PCTcore64.sys

PC Tools PCTcore64.sys is documented by BlackSnufkin BYOVD research and CERT/CC as CVE-2026-8501. The driver creates a PCTCore device interface without restrictive access controls and exposes a process-termination IOCTL reachable by local callers.

UUID / 8f2d3be4-3e25-490f-82bc-0aca16aee101ADDED / 2026-06-16AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.

PCTcore64.sysSample 1 · HVCI unknown

MD5: 60f19af0a9a26851ad9bc2d981afbac6
SHA1: d5609dc8c5215ebe197aad74ea1459a38f3612dd
SHA256: c76dd87891e3e30db2aed057e7b04c19ca264f434c21f68a7a2d9b17a97aff39
Imphash: 28f9f694ebce417cd9f4ae14094a6d41
Authentihash MD5: 7b5b4b739265c7cb20259ab9275bdb96
Authentihash SHA1: 17d5646942678e9fbfb8fe2835c4eb7b5b6d26db
Authentihash SHA256: f02f7cd930d656cbae0ab9d3c3eafd3d8333f182505c539f4ef4032c4c92e725
Machine: AMD64
Version: 2.0.0.37 built by: WinDDK
Publisher: PC Tools

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create PCTcore64 binPath=C:\windows\temp\PCTcore64.sys type=kernel && sc.exe start PCTcore64

Terminate processes through a vulnerable PC Tools kernel driver IOCTL path. · Privileges: kernel · OS: Windows 10, Windows 11

Research & references

Acknowledgement: BlackSnufkin @BlackSnufkin42