Junglewise Threat Intelligence

CVE-2026-15476: QILING Disk Master improper access control in diskbckp.sys kernel driver

CVE-2026-15476 · Severity: medium · CVSS 5.3 · Published 2026-07-12

Executive brief

QILING Disk Master is a backup and recovery software suite. A security vulnerability in its kernel driver allows a standard computer user to bypass Windows security protections and write data directly to the hard drive. This could allow an attacker to modify protected system files, steal sensitive information, or gain full administrative control over the computer.

Technical details

A local privilege escalation vulnerability exists in the QILING Disk Master kernel driver, diskbckp.sys (version 6.0.0.0). The driver exposes the '\\.\diskbakdrv1' device interface with an insecure security descriptor, allowing unprivileged local users to open a handle to it. By issuing specific IOCTLs (such as 0x810C2008 to attach a disk and 0x810C2806/0x810C280A for raw I/O), an attacker can perform arbitrary raw disk writes. This bypasses standard Windows NTFS Discretionary Access Control Lists (DACLs) and raw disk access restrictions, enabling the modification of protected system files, registry hives, or boot configuration to achieve SYSTEM-level privileges.

Affected products

  • QILING Disk Master 6.0.0.0

Timeline

  • 2026-07-12: advisory: CVE-2026-15476 published by NVD/VulDB
  • 2026-07-12: disclosed: Public exploit and technical details released by Winslow Blog

References