Executive brief
Ludashi is a kernel-mode security driver component used for system protection and process management. A missing authorization check in the MessageNotifyCallback function allows a local attacker to execute arbitrary operations like process termination without proper validation, potentially compromising system stability and security controls.
Technical details
The vulnerability is an authorization bypass in the MessageNotifyCallback function within the ProtectFilter64.sys kernel driver component. The flaw permits manipulation of the Message Dispatch Handler without proper access control checks, allowing local attackers to send crafted messages that perform privileged operations such as process termination. Attack requires local access to the system and can be exploited via the minifilter communication port. While the vulnerability has been disclosed publicly with a proof-of-concept available, the vendor (Chengdu Qilu Technology) has not responded to early disclosure notifications, and no patch is currently available.
Affected products
- Chengdu Qilu Technology Ludashi 6.1026.4715.714
Timeline
- 2026-09-13: disclosed
- other: Proof-of-concept exploit published on GitHub