CVE-2026-15515

Executive Summary

CVE-2026-15515 is a locally exploitable uncontrolled search path vulnerability in the QMUDisk driver (qmudisk64.sys) bundled with Tencent PC Manager version 18.1.30242.301. The vulnerability allows an authenticated local attacker to escalate privileges by placing a malicious DLL in a directory that the driver searches before the intended system directory. The attack complexity is high, requiring precise timing and directory manipulation, but a public proof-of-concept (PoC) has been disclosed. No vendor patch has been released, and the vendor did not respond to disclosure attempts. The EPSS score is 0.0%, indicating very low exploitation likelihood in the wild at this time, but the public PoC increases risk for targeted attacks.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a Windows kernel driver distributed as part of Tencent PC Manager, a desktop application. The risk is limited to systems where the software is installed.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.0 (High)
• Attack Vector: Local (AV:L) – requires physical or remote interactive access to the system.
• Attack Complexity: High (AC:H) – requires specific conditions (e.g., writable directory in search path, timing).
• Privileges Required: Low (PR:L) – attacker needs a standard user account.
• User Interaction: None (UI:N) – no user action required beyond initial access.
• Scope: Unchanged (S:U) – the vulnerable component and the impacted component are the same.
• Confidentiality, Integrity, Availability Impact: All High (C:H/I:H/A:H) – full system compromise possible.

Threat Level: High. While exploitation is difficult, the public PoC and lack of patch make this a significant risk for organizations using Tencent PC Manager.

Deep Dive & Mechanics

The vulnerability resides in the qmudisk64.sys driver, which is part of the QMUDisk component of Tencent PC Manager. The driver loads a library (likely a DLL) using an uncontrolled search path. Instead of using a fully qualified path or a safe search order (e.g., LoadLibraryEx with LOAD_LIBRARY_SEARCH_SYSTEM32), the driver relies on the standard Windows DLL search order. This allows an attacker to place a malicious DLL in a directory that is searched before the legitimate system directory (e.g., C:\Users\<username>\AppData\Local\Temp or the application's own directory if writable).

Root Cause: The driver does not specify a safe search path when loading the library, making it susceptible to DLL hijacking.

Attack Scenario:

1. Attacker gains low-privileged access to a system running Tencent PC Manager 18.1.30242.301.
2. Attacker identifies a directory that is in the driver's search path and is writable by the user (e.g., %TEMP% or the application's install directory if permissions are misconfigured).
3. Attacker places a malicious DLL (e.g., version.dll or dbghelp.dll) in that directory.
4. When the driver loads the legitimate library, the system finds the malicious DLL first due to search order.
5. The malicious DLL executes with kernel or high-integrity privileges, allowing full system compromise.

Vulnerable vs. Patched Code

Since no patch is available, a comparison cannot be made. However, a secure implementation would use:

// Vulnerable (conceptual)
HMODULE hMod = LoadLibrary(L"some.dll");

// Patched (conceptual)
HMODULE hMod = LoadLibraryEx(L"C:\\Windows\\System32\\some.dll", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32);

The patched version uses a fully qualified path and a safe search order flag to prevent hijacking.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Windows 10/11 with Tencent PC Manager 18.1.30242.301 installed.
• Low-privileged user account.
• Public PoC (available on exploit disclosure sites).

Lab Setup:

1. Install Tencent PC Manager 18.1.30242.301 on a Windows VM.
2. Create a low-privileged user account.
3. Identify a writable directory in the driver's search path (e.g., C:\Users\<user>\AppData\Local\Temp).

Exploitation Steps:

1. Compile a malicious DLL that spawns a reverse shell or adds a user to the Administrators group.
2. Name the DLL to match the library the driver loads (e.g., version.dll).
3. Place the DLL in the writable directory.
4. Trigger the driver to load the library (e.g., by performing a disk operation that invokes the QMUDisk driver).
5. The malicious DLL executes with high privileges.

Example DLL code (simplified):

// malicious.c
#include <windows.h>

BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
    if (ul_reason_for_call == DLL_PROCESS_ATTACH) {
        // Execute command to add user to Administrators
        system("net localgroup Administrators attacker /add");
    }
    return TRUE;
}

Compile with: x86_64-w64-mingw32-gcc -shared -o version.dll malicious.c

Blue Team

Detection Steps:

1. Monitor for unexpected DLL loads from user-writable directories (e.g., %TEMP%, %APPDATA%).
2. Use Sysmon Event ID 7 (Image loaded) to detect DLLs loaded from non-standard paths.
3. Check for the presence of qmudisk64.sys and verify its digital signature.
4. Monitor for processes spawning from qmudisk64.sys or related components.

Hunting Query (KQL):

DeviceEvents
| where ActionType == "DllLoaded"
| where FileName in~ ("version.dll", "dbghelp.dll", "cryptbase.dll")
| where FolderPath startswith @"C:\Users\"
| where InitiatingProcessFileName == "qmudisk64.sys"

Indicators of Compromise (IOCs)

• File Hashes (SHA-256): (Placeholder – obtain from actual PoC or sample)
  • qmudisk64.sys (legitimate): e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
  • Malicious DLL: Unknown (attacker-specific)
• File Paths:
  • C:\Program Files\Tencent\PC Manager\18.1.30242.301\qmudisk64.sys
  • %TEMP%\version.dll (or other hijacked DLL)
• Registry Keys:
  • HKLM\SYSTEM\CurrentControlSet\Services\QMUDisk (service entry)
• Network Indicators:
  • Outbound connections from malicious DLL (e.g., to attacker C2)
• Process Indicators:
  • qmudisk64.sys loading unexpected DLLs

Detection Engineering

YARA Rule

rule CVE_2026_15515_Qmudisk_Hijack {
    meta:
        description = "Detects malicious DLLs targeting CVE-2026-15515 in Tencent PC Manager"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-15515"
    strings:
        $s1 = "qmudisk64.sys" nocase
        $s2 = "version.dll" nocase
        $s3 = "dbghelp.dll" nocase
        $s4 = "cryptbase.dll" nocase
    condition:
        (uint16(0) == 0x5A4D) and  // MZ header
        (any of ($s2, $s3, $s4)) and
        (for any i in (0..filesize - 256): ( @s1 - i == 0 ))
}

Sigma Rule

title: CVE-2026-15515 - QMUDisk Driver DLL Hijacking
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects DLL load events from user-writable directories by qmudisk64.sys
author: Valters IT
date: 2025-04-10
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15515
logsource:
    product: windows
    service: sysmon
    category: image_load
detection:
    selection:
        ImageLoaded|endswith:
            - '\version.dll'
            - '\dbghelp.dll'
            - '\cryptbase.dll'
        ImageLoaded|startswith:
            - 'C:\Users\'
            - 'C:\Windows\Temp\'
        Image: '*\qmudisk64.sys'
    condition: selection
falsepositives:
    - Legitimate software loading DLLs from user directories (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2026-15515 - Potential QMUDisk DLL Hijack C2 Beacon";
    flow:to_server,established;
    content:"|00 00 00 00|"; depth:4; offset:0;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Note: Suricata rule is generic for C2 detection; specific DLL hijack detection is better suited for host-based rules.

Remediation & Mitigation

Immediate Actions:

1. Disable or uninstall Tencent PC Manager until a patch is released.
2. Restrict user write permissions to directories in the system PATH (e.g., %TEMP%, %APPDATA%).
3. Enable Windows Defender Exploit Guard with ASR rules to block DLL hijacking (e.g., rule Block executable files from running unless they meet a prevalence, age, or trusted list criterion).

Long-term:

1. Monitor vendor for patch release and apply immediately.
2. Implement application whitelisting (e.g., AppLocker) to allow only signed binaries.
3. Use Sysmon and EDR to detect anomalous DLL loads.

Workaround:

• Use Process Monitor to identify the exact DLL being loaded and create a symbolic link or hard link to a safe location, though this is fragile.

Valters IT
DevSecOps & Cyber Threat Intelligence