Improper Access Control in Tonec Internet Download Manager Kernel Driver

CVE-2026-90493 affects Tonec Internet Download Manager versions 6.42 Build 63 and earlier on Windows. The vulnerability exists within the idmwfp.sys kernel driver, which handles filter operations for the application. A local attacker can interact with this driver to perform unauthorized operations due to improper access control mechanisms. Because the driver operates at the kernel level, this vulnerability is a significant risk for privilege escalation and security boundary bypass. Exploitation requires the attacker to already have local access to the target system. Public exploit material is available, increasing the risk of abuse. The vendor has not provided a response or a patch to address the issue at the time of disclosure.

Impact

Successful exploitation of CVE-2026-90493 allows a local user to escalate privileges or perform unauthorized actions at the kernel level. This compromises the integrity of the host operating system, potentially enabling an attacker to disable security software, bypass endpoint protections, or maintain persistence with system-level access. Organizations utilizing affected versions of Internet Download Manager on Windows systems are at elevated risk if local users or low-privileged processes are compromised.

Recommendation

Prioritize restricting local access to the affected Windows systems to mitigate the threat of local privilege escalation. Given that the vendor has not provided a security update, detection and monitoring should focus on identifying unauthorized attempts to interact with the idmwfp.sys driver.

• Monitor system logs for unexpected loading of the idmwfp.sys driver or unusual IOCTL (Input/Output Control) calls directed at this driver if telemetry is available.
• Audit systems running Internet Download Manager to identify instances of the vulnerable version 6.42 Build 63 or earlier.
• If the software is not mission-critical, consider uninstalling or disabling Internet Download Manager until a vendor-supplied patch is available.