CVE-2026-36425 is a vulnerability in the OPSWAT AppRemover driver (ardrv.sys) that is exploited via a bring your own vulnerable driver (BYOVD) technique in a campaign targeting Cambodia. The driver is abused to escalate privileges and terminate security processes, including Microsoft Defender, Huorong Internet Security, and Tencent PC Manager.