CVE-2026-108889

4.4Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

4.4Medium

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-782

Impact

A local attacker with low privileges can terminate arbitrary system processes to disrupt services or disable protections. They need local access to send malicious IOCTL requests to the driver.

Root cause

The driver function sub_14000443C in LWBilling64.sys exposes an IOCTL interface that terminates processes based on a user-supplied PID without verifying caller permissions.

Affected systems

Yungengxin Cloud Billing 2024.11.28.11

CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Fix & remediation

No patch is currently available from the vendor; mitigate by removing or disabling the vulnerable kernel driver LWBilling64.sys, or restrict local host access.

shell

$ sc query LWBilling64

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

A flaw has been found in Yungengxin Cloud Billing 2024.11.28.11. Affected by this vulnerability is the function sub_14000443C in the library LWBilling64.sys of the component IOCTL Process Termination. Executing a manipulation of the argument Pid can lead to exposed ioctl with insufficient access control. The attack needs to be launched locally. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-108889