{"id":"CVE-2026-18606","state":"PUBLISHED","title":"Razer RzUpdateService Named Pipe RzUpdateService.exe privileges management","description":"A weakness has been identified in Razer RzUpdateService 1.10.14.0. Affected by this vulnerability is an unknown functionality of the file C:\\Program Files (x86)\\Razer\\RzUpdateEngineService\\RzUpdateService.exe of the component Named Pipe Handler. Executing a manipulation of the argument lpThreadParameter can lead to improper privilege management. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.","publishedAt":"2026-08-03T16:15:07.966Z","updatedAt":"2026-08-03T16:56:43.523Z","severity":{"score":8.5,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["Razer RzUpdateService"],"affected":[{"vendor":"Razer","product":"RzUpdateService","versions":[{"version":"1.10.14.0","status":"affected"}],"cpes":["cpe:2.3:a:razer:rzupdateservice:*:*:*:*:*:*:*:*"],"modules":["Named Pipe Handler"]}],"references":["https://vuldb.com/vuln/385529","https://vuldb.com/vuln/385529/cti","https://vuldb.com/cve/CVE-2026-18606","https://vuldb.com/submit/852045","https://opcodic.notion.site/Privilege-Escalation-via-Insecure-Named-Pipe-in-RzUpdateService-2d88e7fec518803fa5decf10fb0e1e27"],"weaknesses":["CWE-269","CWE-266"],"ingestedAt":"2026-10-29T20:11:10.572Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/18xxx/CVE-2026-18606.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-18606","state":"PUBLISHED","datePublished":"2026-08-03T16:15:07.966Z","dateUpdated":"2026-08-03T16:56:43.523Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-08-03T07:11:26.825Z"},"containers":{"cna":{"title":"Razer RzUpdateService Named Pipe RzUpdateService.exe privileges management","descriptions":[{"lang":"en","value":"A weakness has been identified in Razer RzUpdateService 1.10.14.0. Affected by this vulnerability is an unknown functionality of the file C:\\Program Files (x86)\\Razer\\RzUpdateEngineService\\RzUpdateService.exe of the component Named Pipe Handler. Executing a manipulation of the argument lpThreadParameter can lead to improper privilege management. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure."}],"affected":[{"vendor":"Razer","product":"RzUpdateService","versions":[{"version":"1.10.14.0","status":"affected"}],"cpes":["cpe:2.3:a:razer:rzupdateservice:*:*:*:*:*:*:*:*"],"modules":["Named Pipe Handler"]}],"references":[{"url":"https://vuldb.com/vuln/385529","name":"VDB-385529 | Razer RzUpdateService Named Pipe RzUpdateService.exe privileges management","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/385529/cti","name":"VDB-385529 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-18606","name":"CVE-2026-18606 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/852045","name":"Submit #852045 | RAZER RzUpdateService 1.10.14.0 Improper Access Controls","tags":["third-party-advisory"]},{"url":"https://opcodic.notion.site/Privilege-Escalation-via-Insecure-Named-Pipe-in-RzUpdateService-2d88e7fec518803fa5decf10fb0e1e27","tags":["exploit","patch"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.5,"vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","baseSeverity":"HIGH"}},{"cvssV3_1":{"version":"3.1","baseScore":7.8,"vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R","baseSeverity":"HIGH"}},{"cvssV3_0":{"version":"3.0","baseScore":7.8,"vectorString":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R","baseSeverity":"HIGH"}},{"cvssV2_0":{"version":"2.0","baseScore":6.8,"vectorString":"AV:L/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-269","type":"CWE","lang":"en","description":"Improper Privilege Management"}]},{"descriptions":[{"cweId":"CWE-266","type":"CWE","lang":"en","description":"Incorrect Privilege Assignment"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-08-03T16:15:07.966Z"},"timeline":[{"time":"2026-08-03T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-08-03T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-08-03T09:16:32.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"opcodic (VulDB User)","type":"reporter"},{"lang":"en","value":"VulDB CNA Team","type":"coordinator"}],"x_generator":["VulDB PVTS v202608"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-03T16:56:09.682684Z","id":"CVE-2026-18606","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-03T16:56:43.523Z"}}]}}}