Skip to content
OpenAdvisories
Medium · 6.9 CVE-2026-92254 EUVD-2026-83737GHSA-g5cw-xv36-rr58

WatchDog Antivirus kernel driver arbitrary file deletion via unauthenticated IOCTL

Published Sep 20, 2026 · Updated Sep 21, 2026 · Assigned by watchdog

Description

Missing Authorization in the IOCTL handlers of the wsdkd.sys kernel drivers in Watchdog WatchDog Antivirus 1.8.640 (driver versions 1.3.0.0 and earlier) on Microsoft Windows allows local, low-privileged attackers to delete arbitrary files with SYSTEM privileges, bypassing NTFS access controls and potentially disabling security products or destabilizing the operating system, via crafted IOCTL requests sent to the \Device\wsdk device.

Affected products

VendorProductAffectedFixed
Watchdog Anti-Virus 1.8.640 – < 1.8.804 1.8.804

References