The qmudisk64.sys driver in Tencent PC Manager performs file lookups without properly sanitizing the search path, allowing a local attacker with write access to a searched directory to cause the driver to load a malicious DLL. Based on the description, it is inferred that the attacker must place the DLL in a directory scanned by the driver. This flaw could compromise the confidentiality, integrity, and availability of the system if exploited, as the DLL would run with the driver's elevated privileges.

Tencent PC Manager version 18.1.30242.301 is affected.

The CVSS score of 7.3 reflects high severity, but the EPSS score is less than 1% and the flaw is not listed in the CISA KEV catalog. Exploitation requires local access, high complexity, and is considered difficult, which lowers the overall risk compared to remotely exploitable vulnerabilities. Based on the description, it is inferred that attackers would need to drop a crafted DLL into a directory that the driver scans, then trigger the driver to load it, potentially elevating privileges or compromising the system.