CVE-2026-90503
LowCVSS 2.3Summary
A flaw has been found in Chengdu Qilu Technology Ludashi 6.1026.4715.714. The affected element is the function sub_11008 in the library ComputerZ_x64.sys. Executing a manipulation of the argument PhysicalAddress can lead to information disclosure. The attack needs to be launched locally. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Risk Assessment
A local attacker can disclose sensitive information from system memory, and the publicly released exploit increases the likelihood of abuse.
Recommendation
Request a fix from the vendor, as they did not respond to the disclosure; until a patch is available, consider restricting or removing Ludashi software.
Other vulnerabilities in Ludashi
See all- CVE-2026-90508Low
A security flaw has been discovered in Chengdu Qilu Technology Ludashi 6.1026.4715.714. Affected by this vulnerability is the function MessageNotifyCallback in the library ProtectFilter64.sys of the component Message Dispatch Handler. Performing a manipulation results in missing authorization. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- CVE-2025-67246High
The Ludashi driver before version 5.1025 has a local information disclosure vulnerability due to missing access control in the IOCTL handler. An unprivileged user can read arbitrary physical memory, including kernel structures, pointers, and security tokens.
Original NVD description (English source)
A flaw has been found in Chengdu Qilu Technology Ludashi 6.1026.4715.714. The affected element is the function sub_11008 in the library ComputerZ_x64.sys. Executing a manipulation of the argument PhysicalAddress can lead to information disclosure. The attack needs to be launched locally. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.