CVE-2026-90493: Internet Download Manager Privilege Escalation

CVE-2026-90493 Overview

CVE-2026-90493 is a local privilege escalation vulnerability in the idmwfp.sys kernel driver shipped with Tonec Internet Download Manager (IDM) for Windows through version 6.42 Build 63. The driver exposes the \\.\IDMWFP device interface to any authenticated local user through an overly permissive security descriptor. Its IOCTL 0x12C028 handler processes registry-operation subcommands without validating the caller's privileges or restricting operations to IDM-owned registry paths. A low-privileged local user can read, create, modify, and delete arbitrary registry values under HKLM and HKU, leading to SYSTEM-level compromise. A public proof of concept is available, and the vendor did not respond to disclosure attempts.

Critical Impact
Any authenticated local user can escalate to SYSTEM by leveraging the kernel driver to modify privileged registry values consumed by Windows services.

Affected Products

Tonec Internet Download Manager for Windows, versions up to and including 6.42 Build 63
The idmwfp.sys Windows Filtering Platform kernel driver component
Windows hosts where IDM has been installed by any user with administrator rights

Discovery Timeline

2026-09-13 - CVE-2026-90493 published to the National Vulnerability Database
2026-09-15 - Last updated in the NVD database

Technical Details for CVE-2026-90493

Vulnerability Analysis

The idmwfp.sys driver creates its device object with a security descriptor equivalent to D:P(A;;GA;;;AU). This grants generic access (GA) to the built-in Authenticated Users (AU) group. Any interactive or service account can therefore open a handle to \\.\IDMWFP and issue IOCTLs directly to a kernel driver running in ring 0.

The IOCTL 0x12C028 handler dispatches on caller-supplied subcommand codes 0x0C through 0x0F. These subcommands map to registry read, create, modify, and delete operations. The handler accepts fully caller-controlled registry paths and value data. It performs registry access from kernel context, meaning the operations execute with the NT AUTHORITY\SYSTEM security context rather than the caller's token.

Because the handler does not impersonate the caller and does not restrict target keys to IDM-owned namespaces, the driver becomes a confused deputy. This class of flaw is tracked as CWE-266: Incorrect Privilege Assignment.

Root Cause

The root cause is a combination of two design defects. First, the device object grants access to the Authenticated Users group instead of restricting the interface to administrators or the IDM user session. Second, the IOCTL handlers omit both caller authentication and target-path allowlisting before performing privileged registry operations.

Attack Vector

Exploitation requires only local access and a standard user account. No user interaction is required. An attacker opens a handle to \\.\IDMWFP, constructs an input buffer specifying subcommand 0x0C–0x0F with a target registry path such as a service ImagePath under HKLM\SYSTEM\CurrentControlSet\Services, and sends the IOCTL. The kernel driver performs the write on behalf of the caller. The attacker then triggers the affected service to gain code execution as SYSTEM.

See the GitHub PoC Report and the GitHub PoC Repository for the full technical write-up and working proof of concept.

Detection Methods for CVE-2026-90493

Indicators of Compromise

Presence of idmwfp.sys at version associated with IDM 6.42 Build 63 or earlier on any Windows endpoint
Non-administrative processes opening handles to the \\.\IDMWFP device object
Unexpected modification of service configuration keys under HKLM\SYSTEM\CurrentControlSet\Services originating from non-installer, non-SYSTEM processes
New or altered auto-start entries under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run written shortly after IOCTL activity to the IDM driver

Detection Strategies

Enable Windows kernel object access auditing and alert on non-elevated processes issuing DeviceIoControl calls with control code 0x12C028 against the IDM device
Correlate registry modification events (Event IDs 4657, 4663) targeting sensitive hives with the parent process context to identify writes not attributable to legitimate installers or SYSTEM services
Monitor for the loaded idmwfp.sys image on hosts where IDM is not an approved application

Monitoring Recommendations

Track child process creation from services whose configuration was recently modified, particularly those started via sc start or service manager APIs by non-administrative users
Baseline the set of processes that legitimately interact with \\.\IDMWFP (the IDM user-mode components) and alert on deviations
Ingest Sysmon Event ID 13 (registry value set) and 12 (registry key create/delete) into a centralized analytics pipeline for cross-host correlation

How to Mitigate CVE-2026-90493

Immediate Actions Required

Inventory all Windows endpoints for the presence of Internet Download Manager and the idmwfp.sys driver
Uninstall Internet Download Manager on hosts where it is not business-critical until a patched build is available
Restrict local logon on servers and shared workstations to reduce the population of accounts that can exploit the driver
Deploy application control policies (Windows Defender Application Control or AppLocker) to block execution of unknown binaries that could invoke the vulnerable IOCTL

Patch Information

No vendor patch is documented at the time of publication. According to the disclosure, Tonec did not respond to the researcher's contact attempts. Monitor the VulDB entry for CVE-2026-90493 and the official IDM vendor site for future updates.

Workarounds

Unload or block the idmwfp.sys driver by disabling the associated service and removing driver load permissions where IDM functionality is not required
Apply a tightened Access Control List to the \\.\IDMWFP device object using kernel driver hardening tools that restrict access to administrators only
Use endpoint protection policies to prevent non-administrative processes from opening handles to third-party kernel driver device objects
Remove Internet Download Manager entirely as the most reliable mitigation until the vendor issues a fixed release

bash

# Query for IDM installation and driver presence on a Windows host
Get-CimInstance Win32_Product | Where-Object { $_.Name -like '*Internet Download Manager*' }
Get-Item 'C:\Windows\System32\drivers\idmwfp.sys' -ErrorAction SilentlyContinue |
    Select-Object FullName, VersionInfo

# Stop and disable the IDM WFP driver service (requires administrative rights)
sc.exe stop idmwfp
sc.exe config idmwfp start= disabled