The weakness is in the ZwTerminateProcess function of the QKSecureIO_Imp.sys Mini Filter Driver bundled with Qi‑ANXIN QAX Virus Removal. It permits improper access controls (CWE‑266, CWE‑284) by allowing manipulation of the function when executed locally. This flaw could let a local attacker terminate arbitrary processes or perform other privileged actions. The description notes the vulnerability is confined to local execution, and it is inferred that exploitation requires running code on the system to manipulate or invoke ZwTerminateProcess.

The problem affects the QKSecureIO_Imp.sys driver in all releases of the Qi‑ANXIN QAX Virus Removal suite released up to the 2025‑10‑22 cutoff; no precise version numbers are supplied beyond that date.

The CVSS score of 4.8 indicates moderate severity, while the EPSS score of less than 1% suggests a very low probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, it is inferred that any user capable of executing code locally could exploit the flaw, potentially gaining privileged capabilities or disrupting system operation by terminating critical processes.