Executive Summary
A high-severity improper access control vulnerability (CVE-2026-90493) has been disclosed in Tonec's Internet Download Manager (IDM) for Windows, one of the most widely installed third-party download accelerators. The flaw lives in idmwfp.sys, IDM's kernel-mode driver: its exposed IOCTL interface doesn't adequately validate the calling process's context or permissions before executing privileged driver functions, letting a low-privileged local user escalate to SYSTEM.
CVSS Score: 8.8 (CVSS 3.1) / 8.5 (CVSS 4.0)
A public proof-of-concept is already available, and Tonec did not respond to pre-disclosure contact — there is currently no vendor patch.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-90493 |
| CVSS Score | 8.8 High (3.1) / 8.5 High (4.0, E:P — exploit PoC published) |
| Type | Improper Access Control (CWE-284), also cross-referenced as CWE-269 / CWE-266 |
| Attack Vector | Local |
| Attack Complexity | Low |
| Privileges Required | Low (any authenticated local user) |
| User Interaction | None |
Affected Versions
| Software | Affected Versions | Fixed Version |
|---|---|---|
| Tonec Internet Download Manager | Up to and including 6.42 Build 63 (Windows) | None — vendor unresponsive |
Attack Vector
1. Attacker obtains low-privileged local code execution on a Windows host
with IDM installed (e.g. via a standard user account or another
foothold)
2. Attacker sends crafted IOCTL requests directly to the idmwfp.sys
kernel driver
3. The driver executes the privileged function without properly
verifying that the calling process is authorized to invoke it
4. Attacker leverages the driver's elevated context to escalate
privileges to SYSTEMA working exploit is public: IDM_LPE_PoC by researcher KnCRJNET, titled "Internet Download Manager (IDM) for Windows ≤6.42 Build 63 Exposed IOCTL with Insufficient Access Control."
Impact of Successful Exploitation
| Impact | Description |
|---|---|
| Privilege Escalation | Local attacker gains SYSTEM-level access |
| Full Host Compromise | SYSTEM privileges enable credential dumping, persistence, and disabling of security controls |
| Wide Install Base | IDM is bundled or manually installed on a large number of consumer and enterprise Windows machines |
This maps to MITRE ATT&CK T1068 (Exploitation for Privilege Escalation).
Why this matters beyond home users: IDM is frequently present on corporate workstations despite not being an IT-sanctioned tool. A signed, third-party kernel driver with a broken access-control model is an attractive privilege-escalation primitive for an attacker who has already landed a low-privileged foothold via phishing or another initial-access vector.
Immediate Remediation
Step 1: Check Your Version
Confirm whether IDM 6.42 Build 63 or earlier is installed across your Windows fleet. Since the vendor has not responded, do not assume a future auto-update will silently fix this.
Step 2: Reduce Exposure
- Uninstall Internet Download Manager where it isn't a business-approved tool — it's commonly installed outside of IT policy
- Block or remove the
idmwfp.sysdriver via application/driver allow-listing (e.g., Windows Defender Application Control, WDAC) if IDM itself must remain installed - Restrict local logon rights on shared or sensitive hosts to reduce the pool of accounts that could stage this exploit
Step 3: Monitor for Abuse
# Monitor for direct IOCTL calls to idmwfp.sys from unexpected
# processes (i.e. not the legitimate IDM application)
# Flag privilege-escalation indicators (new SYSTEM-level processes
# spawned from a standard user session) on hosts running IDMPost-Remediation Steps
- Track Tonec's release notes for any future patch addressing this driver, given the current lack of vendor response
- Inventory all hosts with IDM installed as part of routine third-party software audits
- Treat unmanaged download-manager kernel drivers as a standing risk and consider EDR rules tuned to the public PoC's IOCTL patterns
- Re-evaluate policy on unsanctioned software that ships kernel-mode components, given the elevated blast radius of driver-level bugs