Not scored
CVE-2025-68947
NSecsoft NSecKrnl process termination privilege escalation
NSecsoftNSecKrnl
Status
- Not in CISA KEV
Exploit probabilityEPSSchecked 25 Oct
0.1%probability of exploitation in the next 30 days
Higher than 3% of scored CVEs
SeverityCVSS
–Not scored yet
Description NVD
NSecsoft 'NSecKrnl' is a Windows driver that allows a local, authenticated attacker to terminate processes owned by other users, including SYSTEM and Protected Processes by issuing crafted IOCTL requests to the driver.
Coverage 4 articles · 4 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Mon 9 Feb · 20:50 UTC | Dark Reading | Black Basta Bundles BYOVD With Ransomware Payload |
| Tue 10 Feb · 01:00 UTC | SecurityOnline | Silent Killer: Black Basta Bundles “BYOVD” Driver to Blind Antivirus |
| Tue 10 Feb · 15:55 UTC | The Hacker News | Reynolds Ransomware Embeds BYOVD Driver to Disable EDR Security Tools |
| Wed 11 Feb · 15:25 UTC | Security Affairs | Reynolds ransomware uses BYOVD to disable security before encryption |
- Reynolds ransomware uses BYOVD to disable security before encryptionSecurity Affairs
- Reynolds Ransomware Embeds BYOVD Driver to Disable EDR Security ToolsThe Hacker News
- Silent Killer: Black Basta Bundles “BYOVD” Driver to Blind AntivirusSecurityOnline
- Black Basta Bundles BYOVD With Ransomware PayloadDark Reading · first in our coverage