Description

A maliciously created executable, when executed on the victim's machine, may allow a local low-privileged attacker to inject unauthenticated IPC messages into named pipes, modify pipe permissions or ownership, and potentially impact confidentiality, integrity, and availability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-12T15:17:31.687Z",
  "pubdate": "2026-08-12T15:17:31.687Z",
  "executiveSummary": "This vulnerability involves an Inter-Process Communication (IPC) flaw affecting named pipes, which can be exploited to compromise system integrity, confidentiality, and availability.\nA local, low-privileged attacker executing a maliciously crafted executable on a victim machine can inject unauthenticated IPC messages into named pipes and modify pipe permissions or ownership.\nThe risk implications include unauthorized manipulation of IPC channels, potential elevation of local privileges, and disruption of affected system services.\nExploitation requires the execution of a malicious binary within the local environment, meaning the attacker must already possess local execution access to target the vulnerable IPC mechanisms.",
  "technicalDetails": "The root cause of the vulnerability stems from insecure named pipe handling, lack of proper authentication for IPC message transmission, and overly permissive access control configurations associated with pipe objects.\nThe vulnerable component involves the local IPC subsystem, specifically the named pipe creation and message-handling routines that fail to validate the authenticity of connected clients or restrict discretionary access control lists (DACLs) adequately.\nAuthentication requirements are absent for IPC message injection, and the privilege requirement for the initial attack vector is low, as a local unprivileged user can execute the malicious binary.\nThe attack flow proceeds as follows: First, the attacker introduces and executes a maliciously crafted executable on the victim's machine under a low-privileged security context. Second, the malicious executable interacts with vulnerable named pipes exposed by local services or applications. Third, due to inadequate permission checks and the absence of message authentication, the attacker's process successfully modifies the ownership or permissions of the targeted named pipes. Finally, the attacker injects unauthenticated IPC messages into the communication channel.\nPost-exploitation impact includes the potential interception or spoofing of IPC data flows, unauthorized modification of critical communication pathways, and subsequent degradation or denial of service affecting availability, alongside impacts to confidentiality and integrity."
}