{"uuid": "6d919523-ab25-4dee-9bc5-c1f2efa2ec2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79417", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/196473", "content": "Argus Monitor Local Denial-of-Service Vulnerability (CVE-2026-79417)\nhttps://www.reddit.com/r/redteamsec/comments/1wpwggq/argus_monitor_local_denialofservice_vulnerability/\n\n(1) An exposed IOCTL lets unprivileged users disable the x86 MONITOR (https://www.felixcloutier.com/x86/monitor) & MWAIT (https://www.felixcloutier.com/x86/mwait) instructions used by Hyper-V (https://en.wikipedia.org/wiki/Hyper-V) and other kernel components--triggering a HYPERVISOR_ERROR bugcheck. (2) Reaching the IOCTL requires exploiting a TOCTOU (https://en.wikipedia.org/wiki/Time-of-check_to_time-of-use) bug arguably caused by poor documentation of the SeLocateProcessImageName (https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-selocateprocessimagename) function. (3) Reimplementation of the driver's security through obscurity IOCTL encryption scheme: SHA-256 KDF-derived XOR keystream & CRC16 Checksum. See full write-up (https://connorjaydunn.github.io/blog/posts/argus-monitor-ldos-cve-2026-79417/), and Github (https://github.com/connorjaydunn/CVE-2026-79417) for PoC.    submitted by    /u/p0xq  (https://www.reddit.com/user/p0xq) \n [link] (https://connorjaydunn.github.io/blog/posts/argus-monitor-ldos-cve-2026-79417/)   [comments] (https://www.reddit.com/r/redteamsec/comments/1wpwggq/argus_monitor_local_denialofservice_vulnerability/)", "creation_timestamp": "2026-10-03T03:57:15.000000Z"}