Tencent - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/tencent/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 13 Jul 2026 01:18:23 +0000Tencent PC Manager QMUDisk Driver Uncontrolled Search Path Vulnerability (CVE-2026-15515)https://feed.craftedsignal.io/briefs/2026-07-cve-2026-15515/Mon, 13 Jul 2026 01:18:23 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-cve-2026-15515/A high-severity uncontrolled search path vulnerability (CVE-2026-15515) in the `qmudisk64.sys` component of Tencent PC Manager 18.1.30242.301 allows a local attacker to execute arbitrary code with elevated privileges, despite high complexity and difficult exploitability, due to public exploit disclosure.A security vulnerability, identified as CVE-2026-15515, has been discovered in Tencent PC Manager version 18.1.30242.301. The flaw is specifically located within the qmudisk64.sys library, which is part of the QMUDisk Driver component. This vulnerability stems from an uncontrolled search path, which can lead to privilege escalation. Exploitation requires local user access and is considered to be of high complexity and difficult to achieve, although a public exploit has been disclosed, increasing the risk of its use. Despite early disclosure, the vendor did not respond, indicating a lack of official patch or guidance at the time of publication. This vulnerability poses a significant risk to affected systems as it could allow an attacker to execute malicious code with elevated system privileges.

Attack Chain

  1. Initial Access: An attacker first gains local, unprivileged access to a system running the vulnerable Tencent PC Manager.
  2. Vulnerable Component Identification: The attacker identifies that the qmudisk64.sys driver, part of the QMUDisk Driver component, is susceptible to an uncontrolled search path vulnerability during its operation or loading.
  3. Malicious DLL Placement: The attacker crafts a malicious Dynamic Link Library (DLL) file and strategically places it in a directory that the vulnerable driver or its associated processes search before the legitimate location of required system DLLs.
  4. Trigger Vulnerable Execution: The attacker waits for or actively triggers the vulnerable Tencent PC Manager component or the operating system to load the QMUDisk Driver (qmudisk64.sys) or another component that depends on it.
  5. DLL Hijacking/Sideloading: Due to the uncontrolled search path, the legitimate process attempts to load a required DLL and, finding the attacker's malicious DLL first in its search path, loads and executes it instead.
  6. Privilege Escalation: The malicious DLL executes arbitrary code within the context of the vulnerable driver, typically gaining SYSTEM-level privileges.
  7. System Compromise: With elevated privileges, the attacker can perform further malicious actions, such as installing persistence mechanisms, deploying additional malware, exfiltrating sensitive data, or taking full control of the compromised system.

Impact

Successful exploitation of CVE-2026-15515 allows an attacker with local access to achieve privilege escalation, potentially leading to arbitrary code execution with SYSTEM privileges. This level of access grants the attacker full control over the compromised Windows system, enabling them to bypass security controls, steal sensitive information, install backdoors, or deploy further malicious payloads like ransomware. While the vulnerability requires local access and is considered difficult to exploit, the public disclosure of an exploit significantly lowers the barrier for motivated attackers. The CVSS v3.1 Base Score of 7.0 highlights a high impact on confidentiality, integrity, and availability once exploited.

Recommendation

  • Patch CVE-2026-15515 on all systems running Tencent PC Manager 18.1.30242.301 immediately if a patch becomes available.
  • Restrict local administrative privileges to prevent potential attackers from reaching the necessary access level to exploit this type of vulnerability.
]]>highadvisorycvevulnerabilityprivilege-escalationwindows