A flaw has been found in Yungengxin Cloud Billing 2024.11.28.11. (CVE-2026-108889)

CVE-2026-108889 describes a vulnerability in Yungengxin Cloud Billing version 2024.11.28.11, specifically in the function sub_14000443C within the LWBilling64.sys library's IOCTL Process Termination component. The flaw allows local attackers to manipulate the Pid argument to access an ioctl interface with insufficient access control. This can lead to integrity and availability impacts. Exploit code is publicly available. The vendor was notified but has not issued any response or patch.

The vulnerability allows a local attacker to manipulate process termination ioctl calls due to insufficient access control, potentially leading to integrity and availability issues on the affected system. There is no confidentiality impact reported. The exploit requires local access and user privileges. No known active exploitation in the wild has been reported.

No official fix or patch is currently available, and the vendor has not responded to disclosure. Since the exploit requires local access and privileges, restricting local user permissions and monitoring for unusual ioctl usage may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.