pskmad.sys

Panda Security's pskmad.sys 1.1.0.23 exposes a memory-read interface protected by a caller-supplied named-event and shared-section authentication exchange. An administrator-controlled process can satisfy that exchange and use the accepted handle to read memory through IOCTL 0xB3702C08. Static analysis of this exact sample confirms a path that copies from valid kernel virtual addresses into the IOCTL output. The device grants access to administrators and LocalSystem; this is not a standard-user entry point. This record tracks the newly reported authentication weakness, not the older Panda CVEs, and does not establish affected versions beyond this exact sample.