CVE-2026-90493

A vulnerability was detected in Tonec Internet Download Manager up to 6.42 Build 63 on Windows. The impacted element is an unknown function of the file idmwfp.sys of the component Kernel Driver. The manipulation results in improper access controls. Attacking locally is a requirement. Internet Download Manager for Windows up to and including 6.42 Build 63 installs idmwfp.sys, a Windows kernel driver that exposes the \.\IDMWFP device interface to authenticated local users. The device object is created with an access control descriptor equivalent to D:P(A;;GA;;;AU), granting Authenticated Users generic access to the driver. The driver's IOCTL 0x12C028 handler accepts registry-operation subcommands 0x0C through 0x0F and processes caller-controlled registry paths and values. These handlers do not authenticate the caller, do not enforce the caller's registry permissions, and do not restrict operations to IDM-owned registry namespaces. A low-privileged local authenticated user can therefore read, create, modify, and delete arbitrary registry values under HKLM and HKU through the kernel driver. This includes registry configuration consumed by privileged Windows services and drivers and enables Local Privilege Escalation, high-privilege persistence, unauthorized system configuration disclosure or modification, and compromise of system confidentiality, integrity, and availability. Exploitation requires local access, low privileges, and no user interaction. A public proof of concept is available. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-266
• CWE-284

• https://github.com/KnCRJVirX/IDM_LPE_PoC/blob/main/report_en.md
• https://github.com/KnCRJVirX/IDM_LPE_PoC/tree/main/poc
• https://vuldb.com/cve/CVE-2026-90493
• https://vuldb.com/submit/891910
• https://vuldb.com/vuln/403081
• https://vuldb.com/vuln/403081/cti

Published

Sep 13, 2026

Last Modified

Sep 15, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-90487A vulnerability was found in Xuxueli xxl-job up to 3.4.2. Af…4.3
• CVE-2026-90488A vulnerability was determined in Xuxueli xxl-job up to 3.4.…6.3
• CVE-2026-90489A vulnerability was identified in Xuxueli xxl-job up to 3.5.…3.5
• CVE-2026-90490A security flaw has been discovered in lenve vhr 1.0-SNAPSHO…6.3
• CVE-2026-90491A weakness has been identified in sanjevirau gsubs up to 1.0…6.3
• CVE-2026-90492A security vulnerability has been detected in webgjc web_rob…6.3
• CVE-2026-90494A flaw has been found in restify node-restify up to 12.0.0. …5.3
• CVE-2026-90495A vulnerability has been found in Fengoffice Feng Office up …7.3
• CVE-2026-90496A vulnerability was found in Fengoffice Feng Office up to 3.…4.7
• CVE-2026-90497A vulnerability was determined in Fengoffice Feng Office up …3.5
• CVE-2026-90498A vulnerability was identified in lenve vhr 1.0-SNAPSHOT. Af…7.3
• CVE-2026-90499A security flaw has been discovered in lenve vhr 1.0-SNAPSHO…5.4