CVE-2026-90503CWE-200CWE-284broken-access-controlinformation-disclosure

CVE-2026-90503

Low · published September 13, 2026

CVSS v3.1
2.3
EPSS
0%
Percentile
4.7
In the wild
Unconfirmed
What it is

A flaw has been found in Chengdu Qilu Technology Ludashi 6.1026.4715.714. The affected element is the function sub_11008 in the library ComputerZ_x64.sys. Executing a manipulation of the argument PhysicalAddress can lead to information disclosure. The attack needs to be launched locally. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
2.3 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
4.6 · CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00159 · 4.7th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-284 · Improper Access Control
Published
2026-09-13T13:16Z
References (4)
https://vuldb.com/cve/CVE-2026-90503 · [email protected]https://vuldb.com/submit/895249 · [email protected]https://vuldb.com/vuln/403091 · [email protected]https://vuldb.com/vuln/403091/cti · [email protected]
EPSS history
Timeline
  • 15 SEP 03:22Z
    EPSS moved — → 0%
    epss
  • 13 SEP 08:30Z
    Chengdu Qilu Technology Ludashi ComputerZ_x64.sys sub_11008 information disclosure
    cvelistv5