WCH CH341SER driver installer: DLL hijacking allows privilege escalation

Summary

The setup package CH341SER.EXE version 4.0 of the WCH CH340/CH341 USB-to-serial Windows driver contains a local privilege escalation flaw. The elevated installer component DRVSETUP64.EXE loads DLLs from a directory that standard users can write to, so a local user with low privileges could run attacker-controlled code with the privileges of the elevated installer. Exploitation requires a local account, a writable staging directory and the approval of the normal UAC prompt. A public proof of concept exists.

Affected

• CH341SER.EXE version 4.0 (confirmed in testing)
• Other versions: Unknown.

Fixed in

Unknown. No vendor fix has been confirmed.

Workaround

• Check whether C:\WCH.CN\CH341SER exists and whether standard users can write to it.
• Remove the extracted installer folder after installation.
• Limit local logon to affected machines and apply least privilege.

Exploitation

• Public proof of concept on GitHub.
• No evidence of exploitation in the wild found; not listed in CISA KEV.
• CISA SSVC: exploitation PoC, not automatable, total technical impact.

Our recommendation

• Inventory systems with CH340/CH341 driver installations.
• Apply the workaround now and monitor WCH and NVD for a fixed version and final score.
• Monitor for DLL loads from user-writable paths in the driver directory (EDR or Sysmon).
• Raise priority for shared or unmanaged workstations used by non-admin staff.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  tanuj8124/CVE-2026-106781

Research sources

• GitHub: CVE-2026-106781 researcher write-up and PoC repository github.com
• WCH download page for CH341SER.EXE www.wch-ic.com
• VulDB: CVE-2026-106781 vuldb.com
• OpenCVE: CVE-2026-106781 app.opencve.io
• OffSeq Radar: CVE-2026-106781 radar.offseq.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:18.