Which versions of Tencent PC Manager are affected by CVE-2026-15515?

Tencent PC Manager version 18.1.30242.301 contains a local privilege escalation vulnerability (CVE-2026-15515, CVSS 7.3) for which publicly available exploit code exists, allowing any local system…

Is there a public PoC exploit available for CVE-2026-15515?

Yes, a public proof-of-concept exploit is available for CVE-2026-15515. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-15515?

Within 24 hours: Audit all endpoints running Tencent PC Manager 18.1.30242.301 and assess whether general users (beyond administrators) have local system access, which would amplify exploitation risk. Within 7 days: Deploy or enable endpoint detection and response (EDR) tools to monitor for exploitation patterns including qmudisk64.sys kernel driver abuse and suspicious DLL loading; implement strict local user privilege restrictions. Within 30 days: Evaluate and plan transition to an alternative, actively-patched endpoint protection solution; establish incident response procedures for exploitation indicators.

Tencent PC Manager CVE-2026-15515

Q: What is the CVSS score of CVE-2026-15515?

CVE-2026-15515 has a CVSS 4.0 base score of 6.4 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-43256 MEDIUM

Uncontrolled Search Path Element (CWE-427)

2026-07-13 VulDB

GHSA-6pvh-5mc9-hm57

Information Disclosure Pc Manager Tencent

6.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

6.4 HIGH

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.0 HIGH

Local-only search-path hijack (AV:L) that is hard to win reliably (AC:H) and needs an existing low-priv account (PR:L); no scope change, full C/I/A impact on the host.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 13, 2026 - 01:22 NVD

HIGH MEDIUM

CVSS changed

Jul 13, 2026 - 01:22 NVD

7.3 (HIGH) 6.4 (MEDIUM)

Analysis Generated

Jul 13, 2026 - 00:43 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in Tencent PC Manager 18.1.30242.301. This issue affects some unknown processing in the library qmudisk64.sys of the component QMUDisk Driver. The manipulation leads to uncontrolled search path. The attack must be carried out locally. The attack is considered to have high complexity. The exploitability is assessed as difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Local privilege/impact abuse in Tencent PC Manager 18.1.30242.301 stems from an uncontrolled search path (CWE-427) in the QMUDisk kernel driver library qmudisk64.sys, letting a low-privileged local user coerce loading of an attacker-controlled library to achieve high confidentiality, integrity, and availability impact. Publicly available exploit code exists (the 'qmukiller' proof-of-concept on GitHub), but exploitation is rated high-complexity/difficult and requires local access with existing low-level privileges. No public exploit has been tied to active in-the-wild attacks, and the vendor did not respond to the disclosure, so no fix is currently available.

Technical ContextAI

The affected component is qmudisk64.sys, a 64-bit kernel-mode driver shipped as part of Tencent PC Manager's QMUDisk feature. The root cause is CWE-427 (Uncontrolled Search Path Element): the driver or its associated privileged component resolves a dependent library/module using a search path that a local attacker can influence, so a malicious library planted in an earlier-searched or writable directory is loaded in place of the legitimate one. Because the loading context runs with elevated/kernel-adjacent privileges while the planted content is chosen by a lower-privileged user, this is a classic search-order/DLL-hijack style weakness applied to a security product's driver stack. CPE cpe:2.3:a:tencent:pc_manager identifies Tencent PC Manager as the affected application; the specific build named is 18.1.30242.301.

RemediationAI

No vendor-released patch identified at time of analysis - the vendor was contacted early but did not respond, so no fixed version exists to cite. As compensating controls, restrict local interactive and administrative access to systems running Tencent PC Manager so untrusted low-privileged users cannot stage a malicious library on the host; monitor for or deny write access to directories in the driver/service load path (application directory and any world-writable locations searched before system paths), since search-path hijacking depends on the attacker being able to plant a library where it is loaded first. Consider whether the QMUDisk feature is required and, where consistent with your endpoint-protection needs, evaluate uninstalling or replacing Tencent PC Manager on high-value hosts - noting the trade-off of losing its endpoint functionality. Track the VulDB entry (https://vuldb.com/cve/CVE-2026-15515) for any future vendor fix and validate the public POC's behavior in a lab before assuming impact. Do not deploy unverified third-party patches from the exploit repository.