CVE-2026-90493 is a vulnerability in the kernel driver file idmwfp.sys of Tonec Internet Download Manager up to version 6.42 Build 63 on Windows. The vulnerability results from improper access controls, allowing a local attacker with limited privileges to potentially gain elevated privileges or cause a complete compromise. The vulnerability has a CVSS 3.1 score of 8.8 (high) with vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating local attack vector, low attack complexity, low privileges required, no user interaction, scope changed, and high impact on confidentiality, integrity, and availability. Public exploit code is available, but the vendor has not provided any response or patch.

Successful exploitation can lead to a complete compromise of the affected system, including full confidentiality, integrity, and availability impact. Because the vulnerability is in a kernel driver, it may allow privilege escalation or other critical system-level impacts. The attack requires local access but no user interaction.

No official fix or patch is currently available as the vendor has not responded. Users should restrict local access to trusted users only and monitor for any suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.