CVE-2026-90503 in Ludashi
Summary
by MITRE • 09/13/2026
A flaw has been found in Chengdu Qilu Technology Ludashi 6.1026.4715.714. The affected element is the function sub_11008 in the library ComputerZ_x64.sys. Executing a manipulation of the argument PhysicalAddress can lead to information disclosure. The attack needs to be launched locally. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/19/2026
The vulnerability identified in Chengdu Qilu Technology Ludashi version 6.1026.4715.714 represents a critical security flaw within the system driver ComputerZ_x64.sys, specifically located in the function sub_11008. This component is part of the underlying infrastructure that supports the application's functionality, likely involving hardware enumeration or system information retrieval given the nature of the library name and typical use cases for such drivers on Windows platforms. The core technical issue stems from improper validation or handling of the PhysicalAddress argument passed to this function. In kernel-mode operations, physical addresses are sensitive resources that map directly to memory locations outside the standard virtual address space managed by the operating system's security boundaries. When an application or driver fails to adequately sanitize or verify these inputs before dereferencing them, it creates a pathway for unauthorized data access.
This specific flaw is classified as an information disclosure vulnerability, which aligns with Common Weakness Enumeration identifier CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. The mechanism involves the function sub_11008 reading or exposing memory contents associated with the provided PhysicalAddress without sufficient checks on whether the calling process has the necessary privileges to access that specific physical memory region. Because this occurs in a kernel-mode driver, the consequences are severe as the attacker can potentially read arbitrary physical memory locations if they can control the input parameters. This could lead to the extraction of sensitive data such as cryptographic keys, session tokens, or other confidential information stored in system memory, thereby compromising the integrity and confidentiality of the host system.
The operational impact of this vulnerability is significant due to its local attack vector requirement. An attacker must have valid user credentials on the target machine and be able to execute code within that context to trigger the flaw. While this limits remote exploitation, it does not mitigate the risk for insider threats or situations where malware has already gained a foothold through phishing, drive-by downloads, or other initial access techniques. The fact that an exploit has been published indicates that the technical details are known and accessible to malicious actors, increasing the likelihood of active abuse in the wild. Local privilege escalation is not explicitly stated as the primary outcome here, but information disclosure at this level often serves as a precursor step for further exploitation chains, such as dumping LSASS memory or extracting kernel structures to facilitate elevation of privilege attacks.
From an industry standard perspective, this vulnerability reflects weaknesses commonly associated with CWE-20 and related input validation failures in system-level components. It also maps to the MITRE ATT&CK framework under techniques involving data from local system sources, particularly those that involve reading memory or accessing hardware information without proper authorization checks. The lack of response from Chengdu Qilu Technology regarding early notification highlights a gap in their security incident response process and leaves users exposed until they can manually mitigate the risk through other means.
Mitigation strategies for this vulnerability are primarily defensive since no patch has been released by the vendor. Users should consider uninstalling or disabling Ludashi if it is not strictly necessary, as third-party system utilities often introduce unnecessary attack surfaces in kernel mode. If the software must remain installed, applying strict application control policies via Windows Defender Application Control or similar endpoint protection solutions can prevent unauthorized execution of scripts or binaries that might attempt to exploit this driver function. Additionally, ensuring that all other components on the system are up to date helps reduce the overall risk profile, as attackers often chain multiple vulnerabilities together. Monitoring for unusual memory access patterns or kernel-mode activity using advanced threat detection tools can also help identify attempts to leverage this flaw before significant data exfiltration occurs.