CVE-2026-108889: Exposed IOCTL with Insufficient Access Control in Yungengxin Cloud Billing

This vulnerability affects the function sub_14000443C in the LWBilling64.sys library of Yungengxin Cloud Billing 2024.11.28.11. The exposed IOCTL interface lacks sufficient access control, allowing a local attacker to manipulate the Pid argument in the IOCTL Process Termination component. This can lead to unauthorized operations via the IOCTL interface. The vulnerability requires local access to the system. Exploit code is publicly available. The vendor was contacted but has not issued any response or fix.

An attacker with local access can exploit the insufficient access control in the IOCTL interface to manipulate process termination operations. This could lead to unauthorized termination or interference with system processes. The CVSS 4.0 base score is 4.8 (medium severity), reflecting the local attack vector and limited privileges required. No evidence of active exploitation in the wild is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should restrict local access to trusted users only and monitor for unusual local activity involving the IOCTL interface. Avoid running untrusted code locally until a patch or official mitigation is available.