CVE-2020-36603:

Privilege escalation vulnerability in Genshin Impact's anti-cheat driver allows local users to execute code with SYSTEM privileges.

The mhyprot2.sys driver is an anti-cheat component used by the popular game Genshin Impact. The vulnerability exists because the driver does not properly validate or restrict access to privileged functions, allowing unprivileged users to make function calls that should be restricted. This vulnerability has been actively exploited in the wild, including by ransomware actors who use the vulnerable driver to kill antivirus processes and facilitate ransomware deployment. The driver's signed status makes it particularly dangerous, as it provides a legitimate way to execute privileged operations on Windows systems. Security researchers have developed proof-of-concept exploits demonstrating how the vulnerability can be leveraged to gain SYSTEM privileges, which represents the highest level of access on Windows systems.