Description

A vulnerability was detected in Tonec Internet Download Manager up to 6.42 Build 63 on Windows. The impacted element is an unknown function of the file idmwfp.sys of the component Kernel Driver. The manipulation results in improper access controls. Attacking locally is a requirement. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-13T03:16:27.370Z",
  "pubdate": "2026-09-13T03:16:27.370Z",
  "executiveSummary": "A local privilege escalation vulnerability has been identified in the Tonec Internet Download Manager (IDM) kernel driver, specifically within idmwfp.sys.\nThe vulnerability is classified as an improper access control flaw, which allows a local attacker to interact with the kernel-mode driver in an unauthorized manner.\nThe affected versions include IDM up to 6.42 Build 63 on the Windows operating system.\nSuccessful exploitation requires local access to the target system, potentially enabling an attacker to perform operations that should be restricted, such as arbitrary kernel-mode memory manipulation or privilege escalation.\nDue to the public availability of an exploit and the lack of vendor response, the risk to affected systems is considered critical.\nThis vulnerability highlights a significant failure in the security boundary between user-mode applications and the kernel-mode driver component.",
  "technicalDetails": "The vulnerability resides within the idmwfp.sys kernel driver, a component responsible for Internet Download Manager's network filtering capabilities within the Windows kernel.\nThe root cause is identified as improper access controls during the communication between user-mode processes and the kernel-mode driver, likely through inadequate validation of IOCTL (Input/Output Control) codes or improperly restricted device handles.\nAn attacker with local user privileges can initiate communication with the idmwfp.sys device object. By crafting malicious IOCTL requests, an attacker can bypass standard security checks enforced by the Windows kernel.\nThe attack flow involves the following steps: 1) The attacker identifies the exposed device object provided by idmwfp.sys. 2) The attacker opens a handle to the driver using CreateFile. 3) The attacker sends a specially crafted IOCTL request using DeviceIoControl that targets an undocumented or poorly secured function within the driver.\nBecause the driver operates in kernel mode (Ring 0), improper input validation allows the attacker to read or write to restricted kernel memory, execute arbitrary code with SYSTEM privileges, or disable security mechanisms.\nThe absence of sufficient access control lists (ACLs) on the driver device object allows non-administrative users to successfully interact with these vulnerable functions.\nThis vulnerability is particularly dangerous as it grants the attacker the ability to escalate privileges from a low-integrity process to the highest level of system authority, effectively subverting the operating system's security architecture.\nThe exploit is currently public, significantly lowering the barrier to entry for malicious actors seeking to compromise systems running vulnerable versions of IDM 6.42 Build 63 and earlier."
}