🚨 Critical flaw in security software itself: heap-based buffer overflow in SecureAge CatchPulse kernel driver (saappctl.sys) lets local attackers escalate to SYSTEM — and a public exploit is already out 🔹 CVE-2026-15506 (CVSS 7.8) affects all versions up to 10.9.3 — fixed in 10.9.4 🔹 Low-privilege user can corrupt kernel memory via IOCTL calls to gain full control 🔹 Kernel access = disable EDR, kill security services, or plant boot-level rootkits 🔹 Signed driver could also be weaponized in BYOVD attacks on other systems ⚠️ Update now & add the vulnerable driver to your WDAC blocklist
Post summary
A heap‑based buffer overflow in SecureAge CatchPulse's kernel driver (CVE‑2026‑15506) allows local escalation to SYSTEM; a public exploit exists, and the vulnerability is patched in version 10.9.4 with a recommended driver blocklist.
