CVE-2026-97732

Name of the Vulnerable Software and Affected Versions IRONMACE Ironshield version 1.0.0.167

Description The tvk.sys kernel-mode driver authenticates client executables by verifying expected publisher and root-certificate strings within the WIN CERTIFICATE data, specifically checking for "IRONMACE Co., Ltd." and "DigiCert Trusted Root G4", rather than parsing and validating the PKCS signature data. This flaw allows a local unprivileged attacker to bypass authentication using crafted certificate data to gain access to privileged IOCTL (Input/Output Control) functionality, which is used to communicate with kernel-mode drivers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.