Local Privilege Escalation

FirmaCheck for Windows versions prior to 1.3.16 are susceptible to local privilege escalation and arbitrary code execution due to an unvalidated OpenSSL configuration file path.

A local attacker can exploit multiple vulnerabilities found in GIMP plugins to perform a Denial of Service attack, execute arbitrary code, or disclose confidential information on affected systems.

CVE-2026-9046 describes an insecure permissions vulnerability in Lenovo's Legion Zone and Lenovo App Store Windows applications, distributed exclusively in the Chinese market, which, when installed on a non-system partition, allows a local low-privileged user to execute arbitrary code, leading to high impact on confidentiality, integrity, and availability.

A high-severity vulnerability, CVE-2026-13104, has been identified in specific versions of the Lenovo App Store, exclusively distributed in the Chinese market, which allows a local authenticated user to execute arbitrary code with elevated privileges, potentially leading to full system compromise.

The `garminconnect` Python library versions 0.3.4 and earlier insecurely assigned world-readable file permissions to the `garmin_tokens.json` OAuth token store, allowing local attackers on multi-user systems to steal refresh tokens and gain persistent, unauthorized access to victims' Garmin Connect accounts.

An arbitrary file write vulnerability (CVE-2026-50158) in the `caption-download` MCP tool of the yutu application allows a local attacker, or any process able to reach the unauthenticated HTTP MCP server, to bypass the `YUTU_ROOT` confinement and write arbitrary content to any path writable by the yutu process, leading to potential persistent code execution, privilege escalation, or denial of service.

A local attacker can exploit a vulnerability in wget to bypass existing security measures and perform a Server-Side Request Forgery (SSRF) attack, enabling requests to internal or restricted resources from the local system.

An Improper Access Control vulnerability (CVE-2026-9492) in the MBStorage DRAM lighting control module of Gigabyte Control Center (GCC) allows authenticated local attackers to achieve kernel-level privileges by sending specific IOCTL commands to the `MyPortIO_x64.sys` driver, enabling arbitrary physical memory read/write.

When Cilium L7 functionality is enabled, a world-accessible Envoy admin socket is inadvertently created on cluster nodes. This misconfiguration (CVE-2026-49445) allows a local attacker to gain unauthorized access to Envoy's administrative endpoints, leading to sensitive information disclosure, such as the exposure of TLS secrets, and significant cluster disruption, including the interruption of traffic and the termination of Envoy processes.

A critical local race condition (EDB-52612) exists in Microsoft Windows Defender's MsMpEng.exe, specifically between its cleanup routine (`MpCleanCallbackFunction`) and Volume Shadow Copy creation, allowing Local Privilege Escalation (LPE) to NT AUTHORITY\SYSTEM and temporary disabling of antivirus protection through a use-after-free vulnerability, with a public exploit demonstrating the risk.

This brief describes a high-severity threat on Linux systems where attackers achieve local privilege escalation by executing a non-root process from a user- or world-writable directory that subsequently gains root privileges (UID 0), indicating a successful exploit to achieve full host compromise.

Multiple vulnerabilities, including CVE-2026-45257 (kernel out-of-bounds write) and CVE-2026-49413 (Linux compatibility layer memory mapping), exist in FreeBSD branches 14 and 15, allowing a local unprivileged attacker to achieve privilege escalation.

CodexBar versions prior to 0.32.0 are vulnerable to insecure temporary file handling, allowing local attackers to access sensitive credentials or tamper with build artifacts due to predictable file paths in the release notarization workflow.

SocuSoft iPod Photo Slideshow 8.05 contains a stack-based buffer overflow vulnerability (CVE-2018-25375) in the registration dialog, allowing a local attacker to execute arbitrary code by overwriting the structured exception handler via crafted input.

SIPp 3.6 and earlier contains a local buffer overflow vulnerability (CVE-2018-25356) in command-line argument handling, allowing local attackers to potentially crash the application or execute arbitrary code by supplying oversized input to the -3pcc, -i, or -log_file parameters.

VX Search 10.6.18 contains a local buffer overflow vulnerability (CVE-2018-25328) that allows attackers to overwrite the instruction pointer by supplying an oversized string in the directory field, leading to arbitrary code execution with application privileges.

Atomic Alarm Clock 6.3 is vulnerable to a stack overflow, allowing local attackers to execute arbitrary code by supplying a malicious string to the display name textbox in the Time Zones Clock configuration (CVE-2020-37221).

Radare2 versions prior to 6.1.4 are vulnerable to a path traversal in project deletion, allowing local attackers to recursively delete arbitrary directories by escaping the 'dir.projects' root, leading to integrity and availability loss.

CVE-2026-32221 is a heap-based buffer overflow vulnerability in the Microsoft Graphics Component, allowing a local attacker to execute arbitrary code.

Easy Video to iPod Converter 1.6.20 is vulnerable to a local buffer overflow in the user registration field, allowing a local attacker to overwrite the structured exception handler (SEH) by providing a crafted payload exceeding 996 bytes in the username field, potentially leading to arbitrary code execution with user privileges.

A local attacker can exploit a vulnerability in Vim to execute arbitrary code on a vulnerable system.

Flat Assembler version 1.71.21 is susceptible to a stack-based buffer overflow vulnerability, allowing local attackers to achieve arbitrary code execution by providing a crafted, oversized input file.

PInfo version 0.6.9-5.1 is susceptible to a local buffer overflow vulnerability, enabling local attackers to execute arbitrary code by providing an overly large argument to the '-m' parameter, ultimately allowing for shellcode execution with user privileges.

TiEmu 3.03 is vulnerable to a buffer overflow in ROM parameter handling, enabling local attackers to crash the application or execute arbitrary code by providing an oversized ROM parameter via the command-line interface.

FlexHEX 2.71 is vulnerable to a local buffer overflow in the Stream Name field, allowing local attackers to execute arbitrary code via a structured exception handler (SEH) overflow.

Lavavo CD Ripper 4.20 is vulnerable to a structured exception handling (SEH) buffer overflow, allowing local attackers to execute arbitrary code by supplying a malicious string in the License Activation Name field leading to arbitrary code execution and a bind shell.

Admin Express 1.2.5.485 is susceptible to a local structured exception handling buffer overflow vulnerability, enabling local attackers to execute arbitrary code via a crafted payload in the Folder Path field of the System Compare feature.

A local privilege escalation vulnerability exists in Windows 11 24H2, Windows 11 25H2, and Windows Server 2022 23H2 due to improper handling of untrusted pointers in HTTP.sys via strcat truncation.

A local attacker can exploit multiple unspecified vulnerabilities in Redis to achieve arbitrary code execution on the host system.

Yasr version 0.6.9-5 is vulnerable to a buffer overflow, allowing local attackers to potentially crash the application or execute arbitrary code by providing an overly large argument to the '-p' parameter.

EKG Gadu 1.9~pre+r2855-3+b1 is vulnerable to a local buffer overflow (CVE-2016-20047) in username handling, allowing attackers to execute arbitrary code by providing an oversized username string.

A local privilege escalation vulnerability exists in the Linux Kernel versions ~3.14+ through 6.18-rc5 due to a use-after-free in the proc_readdir_de() function, where a concurrent traversal can dereference a freed entry's fields during network device unregistration, leading to privilege escalation via modprobe_path overwrite.

iSelect 1.4.0-2+b1 contains a local buffer overflow vulnerability, allowing local attackers to execute arbitrary code by supplying an oversized value to the -k/--key parameter and overflowing a 1024-byte stack buffer.