CVE-2026-90508

What it is

A security flaw has been discovered in Chengdu Qilu Technology Ludashi 6.1026.4715.714. Affected by this vulnerability is the function MessageNotifyCallback in the library ProtectFilter64.sys of the component Message Dispatch Handler. Performing a manipulation results in missing authorization. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

At a glance

Exploitability

Can be exploited locally on the machine with an admin-level account. Limited direct impact.

Exploit odds

0.2% chance of exploitation in the next 30 days (EPSS).

Fix

No patch or advisory is linked yet. Look at mitigations or restrict exposure.

Timeline

1. 2026-09-13 10:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-09-15 15:17 UTC Last updatedMost recent change to the record

Details

Published

2026-09-13 10:16 UTC

Last modified

2026-09-15 15:17 UTC

Exploit probability

0.2% · EPSS, next 30 days

Weakness

CWE-862 · Missing authorization

Record status

Deferred

Attack profile CVSS 4.0 · 1.8

Attack vector

Local

Complexity

Low

Attack requirements

None

Privileges needed

High

User interaction

None

Confidentiality

None

Integrity

Low

Availability

Low