libwasys.sys

libwasys.sys is a kernel driver that ships inside OPSWAT's OESIS SDK, an endpoint-compliance library embedded in many corporate posture-check and NAC agents. The library inspects installed security products, encryption state, patch level, and more; the kernel driver is the helper that lets it reach system state a user-mode scan cannot.

It is on the public LOLDrivers list as of October 2026 following the publication of the "KillerLand" proof of concept by researcher Jehad Abudagga, which exercises a process-termination IOCTL (0x22E00C) that resolves the caller-supplied PID and terminates the process from kernel mode. The LOLDrivers reviewers reproduced the static behaviour across versions 10.3.85.0 and 10.3.2951.0; the researcher's protected-process termination result was reported but not independently reproduced in that review. No CVE has been assigned at the time of catalog entry.

Why a corporate helper driver matters here: OPSWAT's SDK is embedded in agents installed by employers, so this driver may be present on a work-managed machine without the user remembering a direct install. The signed binary loads on modern Windows regardless of which agent dropped it.

If a managed endpoint agent is on the system, let the vendor's own update channel push the fixed library; otherwise OESIS does not belong on a personal gaming PC and the installing utility should be identified and removed.

libwasys.sys is listed as a known-vulnerable driver on the public LOLDrivers project. 2 distinct binary hashes matching this filename are on record, meaning multiple versions of the file have been observed.