CVE-2026-94137: Hangzhou Shunwang shzh DOS Vulnerability

CVE-2026-94137 Overview

CVE-2026-94137 is a local denial-of-service vulnerability in Hangzhou Shunwang Technology shzh version 10.7.2.693. The flaw resides in the function sub_180004AC0 inside the kernel driver shdrv_x64.sys, which handles IRP_MJ_DEVICE_CONTROL requests. An authenticated local attacker can manipulate the PID argument passed through an IOCTL to trigger improper resource handling, categorized as [CWE-404] Improper Resource Shutdown or Release. Successful exploitation causes the driver to fail, resulting in a denial-of-service condition on the affected system. The issue requires local access and low-level privileges, and no remote attack vector exists.

Critical Impact
Local low-privileged users can crash the shdrv_x64.sys kernel driver by sending a crafted IOCTL with a malformed PID argument, disrupting host availability.

Affected Products

Hangzhou Shunwang Technology shzh 10.7.2.693
Component: shdrv_x64.sys kernel driver
Handler: IRP_MJ_DEVICE_CONTROL function sub_180004AC0

Discovery Timeline

2026-09-21 - CVE-2026-94137 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-94137

Vulnerability Analysis

The vulnerability exists in the IRP_MJ_DEVICE_CONTROL dispatch routine of shdrv_x64.sys, specifically within the internal function sub_180004AC0. Windows drivers register IOCTL handlers that receive user-mode input through DeviceIoControl calls. When a user-mode process issues an IOCTL to the exposed device object, the driver forwards the input buffer to sub_180004AC0, which extracts a PID (Process Identifier) argument for further processing. The function fails to safely handle values that reference invalid, terminated, or unauthorized processes. This results in improper resource release, which is classified under [CWE-404]. The failure propagates into the kernel driver state and produces a denial-of-service condition affecting the host.

Root Cause

The root cause is improper resource shutdown or release when the driver operates on a caller-supplied PID. The handler does not validate the process reference lifecycle before releasing or dereferencing associated kernel objects. Malformed or unexpected PID values drive the driver into a faulty cleanup path.

Attack Vector

Exploitation requires local access with low privileges. An attacker opens a handle to the driver's device object and issues a crafted DeviceIoControl request targeting the vulnerable IOCTL. By supplying a PID that triggers the mishandled release path, the attacker forces the driver to fail. Remote exploitation is not possible, and no authentication bypass is required beyond standard user access.

// No verified public proof-of-concept is available.
// The vulnerability is triggered via a DeviceIoControl call to shdrv_x64.sys
// with a crafted PID argument routed to sub_180004AC0.
// See VulDB entry 408054 for technical references.

Detection Methods for CVE-2026-94137

Indicators of Compromise

Unexpected system instability or bugchecks referencing shdrv_x64.sys in Windows minidumps.
Event Log entries indicating driver faults or abnormal termination tied to the Shunwang shzh service.
Non-administrative processes opening handles to the shdrv_x64.sys device object outside of normal application workflows.

Detection Strategies

Monitor for user-mode processes issuing DeviceIoControl calls against the Shunwang device object from unexpected parent processes.
Correlate driver load events for shdrv_x64.sys with subsequent kernel-mode faults on the same host.
Hunt for the file hash e3b99f727e59aab08862a161df7e3d7790842a76c42184fb4ba267db14eae4fa referenced in the VirusTotal File Analysis.

Monitoring Recommendations

Enable Windows Error Reporting collection to capture minidumps that identify the faulting driver and stack frame.
Ingest Sysmon Event ID 6 (driver loaded) telemetry to inventory hosts running shdrv_x64.sys.
Alert on repeated bugchecks or service restarts affecting the Shunwang runtime to detect exploitation attempts.

How to Mitigate CVE-2026-94137

Immediate Actions Required

Inventory endpoints running Hangzhou Shunwang Technology shzh version 10.7.2.693 and identify hosts loading shdrv_x64.sys.
Restrict local logon rights on affected systems so untrusted users cannot issue IOCTLs to the vulnerable driver.
Uninstall the Shunwang shzh client on systems where the software is not required for business operations.

Patch Information

No vendor patch has been published in the referenced advisories at the time of NVD publication. Track the VulDB CVE-2026-94137 entry and VulDB Vulnerability #408054 for vendor updates and fixed builds.

Workarounds

Block loading of shdrv_x64.sys through Windows Defender Application Control (WDAC) or AppLocker driver policies where feasible.
Remove or disable the Shunwang device driver service until a vendor fix is available.
Enforce least-privilege on shared workstations to reduce the population of users able to trigger the local IOCTL.

bash

# Query and disable the Shunwang driver service on Windows
sc.exe query shdrv
sc.exe config shdrv start= disabled
sc.exe stop shdrv