blacksnufkin.github.iowriteupCVE-2026-8501: Arbitrary Process Termination in PCTCore64.sys
Analysis of CVE-2026-8501, a vulnerability in the PCTCore64.sys driver that allows arbitrary process termination, enabling a Bring Your Own Vulnerable Driver (BYOVD) attack. Such flaws let attackers with a signed but vulnerable kernel driver kill security/AV processes from user mode, a common technique for disabling endpoint defenses prior to further compromise.
TL;DR BYOVD writeup on CVE-2026-8501, a PCTCore64.sys driver flaw enabling arbitrary process termination for EDR/AV killing.
CVEs named here
- CVE-2026-8501
Technologies named here
- PCTCore64.sys
Techniques named here
- BYOVD
Related in Offensive Security
huntress.comwriteupAI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress
github.comrepoYesWeHack Claude Kit
huntress.comwriteupInside an Oracle Database SQL Injection Attack | Huntress
huntress.comwriteup