Privilege Escalation in WCH CH340/CH341 USB-to-Serial Driver

Executive Summary

CVE-2026-106781 is a DLL search-order hijacking vulnerability in the WCH CH340/CH341 USB-to-Serial Windows Driver installation package version 4.0. The installer extracts components into directories writable by standard users. The elevated DRVSETUP64.EXE process searches its application directory for DLL dependencies before loading trusted DLLs from the system directory.

Useful 0 Not Useful 0

Detection Guidance

Check if CH341SER.EXE version 4.0 is installed by searching for the file in system directories. Monitor for unexpected DLL loads in the driver installation directory during setup. Review directory permissions for writable folders used by the installer.

Useful 0 Not Useful 0

Impact Analysis

A local user with write access to the staging directory could execute attacker-controlled code with elevated privileges. Exploitation requires user approval via UAC but does not bypass it. The impact depends on the user account and system configuration.

Useful 0 Not Useful 0

Mitigation Strategies

Restrict write permissions to the driver installation directory. Avoid installing version 4.0 of CH341SER.EXE. Use secure DLL-loading APIs and validate all extracted files during installation. Monitor for unauthorized DLL loading attempts.

Useful 0 Not Useful 0