CVE-2026-90503: Ludashi ComputerZ_x64.sys Disclosure Flaw

CVE-2026-90503 Overview

CVE-2026-90503 is an information disclosure vulnerability in Chengdu Qilu Technology Ludashi version 6.1026.4715.714. The flaw resides in the sub_11008 function within the ComputerZ_x64.sys kernel driver. An authenticated local attacker can manipulate the PhysicalAddress argument to read kernel-accessible memory. The weakness is classified as [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor. According to the VulDB advisory, the vendor was contacted early but did not respond, and a public exploit has been published.

Critical Impact
Local attackers with high privileges can read physical memory through the vulnerable driver, potentially exposing sensitive kernel data, credentials, and cryptographic material.

Affected Products

Chengdu Qilu Technology Ludashi 6.1026.4715.714
ComputerZ_x64.sys kernel driver component
Windows systems with the affected Ludashi driver installed

Discovery Timeline

2026-09-13 - CVE-2026-90503 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90503

Vulnerability Analysis

The vulnerability exists in the sub_11008 function inside the ComputerZ_x64.sys driver shipped with Ludashi 6.1026.4715.714. The driver accepts a user-supplied PhysicalAddress argument without adequate validation. Manipulating this argument leads to disclosure of memory contents that should remain inaccessible to unprivileged callers.

Because the affected code runs in kernel context, the disclosed content may include kernel structures, secrets held in physical memory, and data belonging to other processes. The issue is tracked as [CWE-200]. VulDB reports that a public exploit exists, increasing the operational risk for systems running the vulnerable driver.

Root Cause

The root cause is insufficient validation of an IOCTL input parameter. The sub_11008 routine treats the caller-controlled PhysicalAddress argument as trusted and returns the corresponding memory contents to user mode. Kernel drivers that expose physical memory reads to non-privileged interfaces bypass Windows memory protections and expose the entire physical address space.

Attack Vector

Exploitation requires local access and an authenticated context with high privileges, as indicated by the CVSS 4.0 vector components AV:L and PR:H. An attacker opens a handle to the driver device object and issues a crafted IOCTL that passes an attacker-chosen PhysicalAddress value. The driver returns memory contents from that address, which the attacker parses for sensitive information. No user interaction is required. Refer to the VulDB entry for CVE-2026-90503 for additional technical detail.

Detection Methods for CVE-2026-90503

Indicators of Compromise

Presence of ComputerZ_x64.sys version associated with Ludashi 6.1026.4715.714 on endpoints
Unexpected handle opens against the Ludashi driver device object by non-Ludashi processes
Unusual IOCTL traffic patterns targeting the driver from low-integrity or scripting processes

Detection Strategies

Inventory endpoints for installations of Chengdu Qilu Technology Ludashi and flag version 6.1026.4715.714
Monitor for process creation and file access events referencing ComputerZ_x64.sys
Alert on non-Ludashi processes issuing DeviceIoControl calls against the driver

Monitoring Recommendations

Enable driver-load auditing on Windows and forward events to a central SIEM
Correlate kernel driver activity with process lineage to identify anomalous callers
Track privilege-use events on hosts where the vulnerable driver is present

How to Mitigate CVE-2026-90503

Immediate Actions Required

Identify and inventory all endpoints running Ludashi 6.1026.4715.714
Uninstall the affected Ludashi build where the software is not business-critical
Restrict local administrative privileges to reduce the population of accounts that can meet the PR:H precondition

Patch Information

No vendor patch is currently referenced in the CVE record. The VulDB advisory notes the vendor was contacted about the disclosure but did not respond. Monitor the vendor for an updated release of Ludashi and apply it as soon as it becomes available.

Workarounds

Remove the Ludashi application to unload ComputerZ_x64.sys from affected systems
Block loading of the vulnerable driver using Microsoft's vulnerable driver blocklist or WDAC policies
Limit interactive local logons on sensitive hosts to trusted administrators only

bash

# Example: query for the presence of the vulnerable driver on Windows
sc query ComputerZ_x64
driverquery /v | findstr /i ComputerZ_x64.sys