CVE-2026-90493
Tonec Internet Download Manager Kernel Driver idmwfp.sys access control
HIGH 8.5EPSS 0.2%
A vulnerability was detected in Tonec Internet Download Manager up to 6.42 Build 63 on Windows. The impacted element is an unknown function of the file idmwfp.sys of the component Kernel Driver. The manipulation results in improper access controls. Attacking locally is a requirement. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Affected
- Tonec · Internet Download Manager
- CVSS v4.0 VULDB
- 8.5 HIGH
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS v3.1 VULDB
- 8.8 HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - CVSS v2.0 VULDB
- 6.8 MEDIUM
AV:L/AC:L/Au:S/C:C/I:C/A:C - EPSS
- 0.15% chance of exploitation in the next 30 days, 4th percentile
- Published
- 2026-09-13
- Updated
- 2026-09-15
Proof-of-concept exploits (1)
- KnCRJVirX/IDM_LPE_PoC/blob/main/report_en.md1★ · 2026-09-16