CVE-2026-15515 Overview
CVE-2026-15515 is an uncontrolled search path vulnerability [CWE-426] in Tencent PC Manager version 18.1.30242.301. The flaw resides in the qmudisk64.sys library, which is part of the QMUDisk Driver component. A local attacker with low privileges can manipulate the driver's search path to load attacker-controlled resources. Public disclosure of the exploit has occurred, and the vendor did not respond to disclosure attempts.
Critical Impact
Successful exploitation compromises confidentiality, integrity, and availability at the kernel driver level, potentially enabling privilege escalation on affected Windows endpoints running Tencent PC Manager.
Affected Products
- Tencent PC Manager 18.1.30242.301
- Component: QMUDisk Driver (qmudisk64.sys)
- Windows systems with the vulnerable driver loaded
Discovery Timeline
- 2026-07-13 - CVE-2026-15515 published to NVD
- 2026-07-15 - Last updated in NVD database
Technical Details for CVE-2026-15515
Vulnerability Analysis
The vulnerability is classified as an uncontrolled search path element [CWE-426] affecting the qmudisk64.sys kernel driver shipped with Tencent PC Manager. When the driver or its associated user-mode components resolve dependencies, the search path is not sufficiently constrained. This allows a local attacker to influence which resource is loaded during driver operation. Because the affected component executes in kernel context, successful manipulation can result in loss of confidentiality, integrity, and availability on the host.
The attack requires local access and low privileges. Exploitation complexity is high, and the exploit reliability is described as difficult. A proof-of-concept has been published on GitHub in the subsubsub1231/qmukiller repository.
Root Cause
The root cause is improper restriction of a search path used by the QMUDisk Driver library. When a Windows component references a file or module without a fully qualified path, the operating system's search order can be abused to prefer an attacker-planted artifact. In the context of a signed kernel driver, this weakness can be leveraged to load or reference untrusted content in a trusted execution path.
Attack Vector
An attacker requires local access to the target system and low-privileged code execution. The attacker plants a controlled resource in a directory that appears earlier in the search order than the legitimate target. When the QMUDisk Driver resolves the dependency, it consumes the attacker's artifact instead of the intended one. The high attack complexity reflects the difficulty of winning the search order and satisfying the driver's operational preconditions.
No verified exploitation code is reproduced here. Refer to the GitHub PoC Repository and the VulDB CVE-2026-15515 entry for technical details.
Detection Methods for CVE-2026-15515
Indicators of Compromise
- Presence of qmudisk64.sys matching Tencent PC Manager version 18.1.30242.301 on managed endpoints.
- Unexpected files placed alongside Tencent PC Manager binaries or in directories searched by the QMUDisk Driver.
- Kernel driver load events referencing modules from non-standard directories.
Detection Strategies
- Inventory endpoints for the vulnerable Tencent PC Manager build and flag hosts with qmudisk64.sys loaded.
- Monitor file creation events in directories used by Tencent PC Manager for suspicious executables or libraries dropped by low-privileged users.
- Correlate driver load telemetry with process ancestry to identify unusual callers interacting with the QMUDisk Driver.
Monitoring Recommendations
- Enable Windows kernel driver load auditing and forward events to a centralized log platform.
- Alert on write operations to Tencent PC Manager installation paths performed by non-installer processes.
- Track privilege escalation patterns following user-mode interactions with qmudisk64.sys.
How to Mitigate CVE-2026-15515
Immediate Actions Required
- Identify all systems running Tencent PC Manager 18.1.30242.301 and restrict local access to trusted users only.
- Remove or uninstall Tencent PC Manager where operationally feasible until a vendor fix is released.
- Restrict write permissions on directories referenced by the QMUDisk Driver to prevent path hijacking.
Patch Information
No vendor patch is documented in the available references. The vendor was contacted prior to disclosure but did not respond. Monitor the VulDB Vulnerability Overview for updated remediation guidance and any future advisory from Tencent.
Workarounds
- Uninstall Tencent PC Manager on systems where it is not required.
- Enforce least-privilege on Windows endpoints to limit local, low-privileged execution paths that could stage the attack.
- Apply application allowlisting to prevent unauthorized binaries from loading in Tencent PC Manager directories.
- Audit and harden filesystem ACLs on the driver's installation and working directories.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
