Forcefield 1.2.1
Released on Sep 18, 2026
Overview
Forcefield 1.2.1 strengthens protection against code injection, tampering, and driver vulnerabilities. It also improves installer feedback and ensures the service starts correctly after SYSTEM-context deployments.
Changes
FF-19: Installer fails explicitly with an error message instead of failing silently on incompatible host architecture
FF-22: Resolves issue with SYSTEM-context deployments (e.g., Intune) so Forcefield service properly auto-starts on login after reboot
FF-25: Fixes denial-of-service / buffer overflow vulnerability in keeperforcefield.sys during Authenticode hash calculation
FF-26: Fixes vulnerability allowing bypass of Forcefield protections via thread manipulation
FF-27: Adds keeperdb-desktop.exe (KeeperDB) to the driver's list of protected processes
FF-28: Resolves bypass vulnerability involving DLL injection into trusted sihost.exe process
FF-29: Adds keeperforcefield.exe to driver protected process list for self-protection against tampering
FF-30: Updates handle stripping to remove PROCESS_VM_WRITE and PROCESS_VM_OPERATION to prevent code injection
FF-31: Corrects driver process name from keeper-gateway-service.exe to keeper-gateway.exe
VM-1367: Bugcrowd vulnerability report for keeperforcefield.sys kernel pool buffer overflow
Resources
Last updated