Privilege escalation in Tonec Internet Download Manager
CVE-2026-90493
A vulnerability was detected in Tonec Internet Download Manager up to 6.42 Build 63 on Windows. The impacted element is an unknown function of the file idmwfp.sys of the component Kernel Driver. The manipulation results in improper access controls. Attacking locally is a requirement. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Tonec Internet Download Manager — versions 6.42 Build 63
Weakness classification (CWE)
References
- cna@vuldb.com (vdb-entry)
- cna@vuldb.com (signature, permissions-required)
- cna@vuldb.com (third-party-advisory)
- cna@vuldb.com (third-party-advisory)
- cna@vuldb.com (exploit)
Frequently asked questions
- What is CVE-2026-90493?
- CVE-2026-90493 is a high-severity vulnerability in Tonec Internet Download Manager, classified under Incorrect Privilege Assignment. CVSS score: 8.8/10. Published 2026-09-13.
- How severe is CVE-2026-90493?
- High severity. CVSS v3 base score is 8.8 out of 10.