CVE-2026-94137 in shzh
Summary
by MITRE • 09/21/2026
A vulnerability was identified in Hangzhou Shunwang Technology shzh 10.7.2.693. This affects the function sub_180004AC0 of the file shdrv_x64.sys of the component IRP_MJ_DEVICE_CONTROL Handler. The manipulation of the argument PID leads to denial of service. The attack must be carried out locally.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/21/2026
The identified vulnerability in Hangzhou Shunwang Technology's shzh version 10.7.2.693 represents a critical security flaw within its kernel-mode driver, specifically located in the file shdrv_x64.sys. This component is responsible for handling input/output control requests directed at device objects via the IRP_MJ_DEVICE_CONTROL handler mechanism. The core of the issue resides in the function sub_180004AC0, which processes specific arguments passed during these control operations. A thorough technical analysis reveals that the flaw stems from improper validation or bounds checking when handling the Process Identifier argument within this routine. When an attacker supplies a manipulated PID value to this handler, it triggers an exception or error condition deep within the kernel execution context rather than being gracefully rejected by user-mode boundary checks.
This specific implementation defect leads directly to a denial of service scenario for the affected system. Because the vulnerability exists in a kernel driver, any unhandled exception triggered by the malformed PID argument will likely cause the operating system's bug check mechanism to activate. This results in an immediate and forced reboot of the host machine or a complete freeze requiring manual intervention. The impact is severe as it compromises the availability of the entire system rather than just the specific application using the driver. Local attackers can exploit this condition by crafting a specially designed IOCTL request that targets the vulnerable function, thereby destabilizing the kernel environment without needing elevated privileges beyond what is required to open and communicate with the device object associated with shdrv_x64.sys.
From an industry standard perspective, this vulnerability aligns closely with CWE-20 Improper Input Validation, as the driver fails to adequately sanitize or verify the PID argument before processing it within kernel space. Furthermore, in terms of tactical classification under the MITRE ATT&CK framework, this exploit vector falls under T1564.003 Hidden Window and potentially relates to privilege escalation attempts if the denial of service is used as a distraction for other malicious activities, though its primary manifestation here is availability disruption via local exploitation. The requirement for local access means that an attacker must already have some level of foothold on the system, such as through phishing or physical access, but once inside, they can disrupt critical operations with minimal effort.
Mitigation strategies should focus primarily on vendor-supplied patches if available from Hangzhou Shunwang Technology to address the input validation logic in sub_180004AC0. In the absence of an immediate patch, administrators should consider restricting access to the device object associated with shdrv_x64.sys using Windows security descriptors or discretionary access control lists to limit which users and processes can issue IOCTL requests. Additionally, deploying endpoint detection and response solutions that monitor for abnormal kernel behavior or frequent system crashes triggered by specific driver interactions may help in detecting exploitation attempts early. Regular auditing of installed drivers and ensuring they are updated from trusted sources remains a fundamental best practice to prevent such vulnerabilities from being leveraged against organizational infrastructure.