CVE-2026-15515: Tencent PC Manager QMUDisk Driver qmudisk64.sys uncontrolled search path
Vulnerability summary
CVE-2026-15515 is a high (CVSS 7.3) Untrusted Search Path vulnerability in tencent pc manager. EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 5.1% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Timeline
- 13-07-2026PublishedVulnerability first disclosed.
- 15-07-2026Last modifiedVulnerability information updated.
Description
A security vulnerability has been detected in Tencent PC Manager 18.1.30242.301. This issue affects some unknown processing in the library qmudisk64.sys of the component QMUDisk Driver. The manipulation leads to uncontrolled search path. The attack must be carried out locally. The attack is considered to have high complexity. The exploitability is assessed as difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS metrics
7 scores · 2 sources · 4 versions- NVDNIST6.4MediumCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XDiffers
- NVDNIST7.0HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST6.0MediumAV:L/AC:H/Au:S/C:C/I:C/A:C
EPSS trend
Probability
0.16%
Chance of exploitation in the next 30 days
Percentile
5%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.16% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundQmukiller
Maturity: poc
Weaknesses
CWE · root cause- CWE-426Untrusted Search PathThe product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
- CWE-427Uncontrolled Search Path ElementThe product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
Affected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Tencent1 product
- pc manager18.1.30242.301
1 vendor · 1 product
References
5 links- vuldb.com/vuln/377844VDB Entry
- vuldb.com/cve/CVE-2026-15515Third Party Advisory
- vuldb.com/submit/848643Third Party Advisory