---
id: "CVE-2026-126785"
page: "https://infrastack.ai/live/CVE-2026-126785"
kind: "vulnerability"
aliases: ["CVE-2026-126785"]
title: "TR-VISION HOME: incorrect default permissions in fan manager driver"
severity: "critical"
cvss: 9.3
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "TR-VISION HOME", "fixed": [], "affected": "2.0.5", "ecosystem": "vendor"}]
ecosystems: []
tags: ["driver", "local-privilege-escalation", "other", "thermalright", "tr-vision-home", "windows"]
not_affected_if: ["no-local-access", "no-tr-vision-home"]
published_at: "2026-11-12T01:17:11+00:00"
first_seen_at: "2026-11-12T01:39:26+00:00"
updated_at: "2026-11-12T01:40:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126785", "first_seen_at": "2026-11-12T01:39:26+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126785", "first_seen_at": "2026-11-12T01:40:54+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-126785", "https://www.thermalright.com/support/download/"]}]
exploit_sources: []
---

# TR-VISION HOME: incorrect default permissions in fan manager driver

Link for people: https://infrastack.ai/live/CVE-2026-126785 (this .md is for agents)

TR-VISION HOME 2.0.5 has a flaw in the WFanManager.sys driver's IOCTL handler where default permissions are set incorrectly. A local user on the machine can use it to gain more privileges than intended.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:TR-VISION HOME affected 2.0.5 fixed no fixed version listed

## How to check

- Check whether Thermalright TR-VISION HOME (legacy Frozen Vision software) is installed and its version is 2.0.5, the latest the vendor lists.
- Look for WFanManager.sys on the machine (installed driver or loaded service).
- The sources do not name other versions; earlier builds may also carry the driver but that is unconfirmed.

## Fix

No fixed version: the vendor did not respond and its download page lists 2.0.5 as the latest. Until a patch ships, uninstall TR-VISION HOME and remove the WFanManager.sys driver service on shared or multi-user machines, or limit local logins.

## Timeline

- 2026-11-12T01:39:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126785
- 2026-11-12T01:40:54+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-126785 — NVD (VulDB CNA) only; vendor (Thermalright) did not respond; its download page lists V2.0.5 as latest, so no fixed build known. No PoC or exploitation found. Nothing verified: no vendor advisory.

## Documents

- [advisory] NVD CVE-2026-126785 https://nvd.nist.gov/vuln/detail/CVE-2026-126785
- [describes] Thermalright TR-VISION HOME download page (latest V2.0.5) https://www.thermalright.com/support/download/

## From the sources

A vulnerability has been found in rmalright TR-VISION HOME 2.0.5. Impacted is the function sub_11504 in the library WFanManager.sys of the component IOCTL Handler. Such manipulation leads to incorrect default permissions. The attack must be carried out locally. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_