CVE-2026-90508
LowCVSS 3.4Summary
A security flaw has been discovered in Chengdu Qilu Technology Ludashi 6.1026.4715.714. Affected by this vulnerability is the function MessageNotifyCallback in the library ProtectFilter64.sys of the component Message Dispatch Handler. Performing a manipulation results in missing authorization. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Risk Assessment
A local attacker can exploit the missing authorization to perform unauthorized operations on the system, and the publicly available exploit increases the risk of abuse.
Recommendation
Contact the vendor for a fix, as they did not respond to the disclosure; until a patch is available, consider restricting or removing Ludashi software.
Other vulnerabilities in Ludashi
See all- CVE-2026-90503Low
A flaw has been found in Chengdu Qilu Technology Ludashi 6.1026.4715.714. The affected element is the function sub_11008 in the library ComputerZ_x64.sys. Executing a manipulation of the argument PhysicalAddress can lead to information disclosure. The attack needs to be launched locally. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CVE-2025-67246High
The Ludashi driver before version 5.1025 has a local information disclosure vulnerability due to missing access control in the IOCTL handler. An unprivileged user can read arbitrary physical memory, including kernel structures, pointers, and security tokens.
Original NVD description (English source)
A security flaw has been discovered in Chengdu Qilu Technology Ludashi 6.1026.4715.714. Affected by this vulnerability is the function MessageNotifyCallback in the library ProtectFilter64.sys of the component Message Dispatch Handler. Performing a manipulation results in missing authorization. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.