Analysis and Exploitation of an ESET Vulnerability
Summary: Project Zero's Tavis Ormandy published a working remote root exploit for an ESET vulnerability in June 2015, showing that arithmetic operations on ESP bypass the bounds check on the emulator's 40-byte shadow stack, letting attackers build a write-what-where primitive. Because ESET's minifilter or kext intercepts all disk I/O and emulates any executable code it detects, all supported ESET products and platforms in their default configuration were affected, and ESET released a scan engine update on 22-Jun-2015.
Bottom line: Exploitation requires zero user interaction and grants NT AUTHORITY\SYSTEM on Windows or root on Mac and Linux, which Ormandy notes makes it a perfect candidate for a worm that could rapidly compromise an entire corporate fleet.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026