Tencent PC Manager CVE-2026-15515

Exploitation requires local access to a Windows host running Tencent PC Manager 18.1.30242.301 with the QMUDisk Driver (qmudisk64.sys) component installed and active, plus an existing low-privileged account (PR:L) able to write an attacker-controlled library into a directory that appears in the driver/service's uncontrolled search path. Limiting factors are significant: the attack vector is strictly local (AV:L) with no remote entry, attack complexity is high (AC:H) and exploitability is rated 'difficult', and success depends on winning the library search-order resolution - meaning a hardened path configuration or non-writable load directories can prevent it. No user interaction is required (UI:N), but the specific vulnerable build and the QMUDisk feature must be present.

The CVSS 4.0 vector (AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/E:P, base 7.3) describes a locally-exploitable, high-complexity flaw needing low privileges but no user interaction, with full high impact to confidentiality, integrity, and availability and no scope change. The E:P (Proof-of-Concept) exploit maturity aligns with the reported publicly available POC ('qmukiller'). This is NOT a mass-exploitation/network threat: the local vector, high attack complexity, and 'difficult' exploitability rating meaningfully constrain real-world risk, and it is not listed in CISA KEV, indicating no confirmed active exploitation. There is a mild signal tension: the tags label this 'Information Disclosure', yet the CVSS marks full VI:H/VA:H (integrity and availability impact), consistent with local privilege escalation or defense/AV tampering rather than pure disclosure - verify the true impact against the POC/vendor before final triage. Overall this is a moderate-priority local issue, elevated by the existence of public exploit code and the absence of a vendor patch, but not an emergency for internet-facing exposure.

A local attacker who already has a low-privileged foothold on a Windows host running Tencent PC Manager plants a malicious library in a directory searched by the QMUDisk driver component before the legitimate path. When the privileged driver/service resolves and loads that library, the attacker's code executes in the elevated context, enabling privilege escalation or tampering with the security product. A public POC ('qmukiller', https://github.com/subsubsub1231/qmukiller) reportedly demonstrates the technique, though the attack is rated high-complexity and difficult to execute reliably.