CVE-2026-106781 in CH340 CH341 USB-to-Serial Driver
Summary
by MITRE • 10/26/2026
An issue in WCH CH340/CH341 USB-to-Serial Windows Driver setup package CH341SER.EXE version 4.0 allows a local attacker to escalate privileges.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
The vulnerability identified within the WCH CH340 and CH341 USB-to-Serial Windows Driver installation utility, specifically in the executable file CH341SER.EXE version 4.0, represents a critical security flaw that facilitates local privilege escalation. This issue stems from improper handling of administrative permissions during the software installation process. When an unprivileged user executes this setup package, the installer fails to adequately enforce least-privilege principles or properly validate its own integrity before performing system-level modifications. Consequently, the application may execute commands with elevated privileges without requiring explicit authentication for those specific actions, allowing a local attacker who has access to the executable to gain higher levels of control over the operating system than originally intended by the security policy.
From a technical perspective, this flaw aligns closely with CWE-269, which categorizes Improper Privilege Management vulnerabilities where an actor is able to assume privileges that they should not be allowed to have. The root cause typically involves insecure design patterns in how the installer interacts with system directories or registry keys, potentially relying on implicit trust rather than explicit authorization checks for every administrative task performed during installation. This behavior creates a pathway for privilege escalation because the attacker can leverage the elevated context of the installer process to modify critical system configurations, install malicious drivers, or alter security settings that are normally restricted to administrators.
The operational impact of this vulnerability is significant as it compromises the integrity and confidentiality of the affected Windows systems. An attacker with local access could use this flaw to bypass standard user account controls, effectively taking over the machine by installing backdoors, stealing sensitive data stored in administrative contexts, or disabling security software such as antivirus programs that require elevated privileges to function correctly. This type of vulnerability is particularly dangerous in environments where users may not distinguish between trusted vendor utilities and potentially malicious payloads, especially if the CH341SER.EXE file is obtained from an untrusted source or intercepted during transit.
To mitigate this risk, organizations should ensure that they are using the latest version of the WCH USB-to-Serial driver software, as vendors often release patches to address such privilege escalation flaws in subsequent updates. It is also advisable to restrict execution permissions for installation utilities through application control policies like AppLocker or Windows Defender Application Control, ensuring that only authorized and verified versions can run with administrative rights. Furthermore, users should exercise caution when downloading drivers from third-party sites and verify the digital signatures of executables before running them. Regularly auditing installed software and monitoring for unusual privilege changes in system logs can also help detect exploitation attempts early. This vulnerability is relevant to MITRE ATT&CK techniques related to Privilege Escalation via Local Exploitation, highlighting the need for robust input validation and strict permission enforcement in all administrative tools distributed by hardware vendors.