Description

UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover cleartext vault data from process memory even after the application has been locked. Attackers can use the PROCESS_VM_READ permission to read the memory space of UpSignOn.exe and extract sensitive fields including entry names, URLs, usernames, passwords, TOTP secrets, and notes.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-02T20:17:37.033Z",
  "pubdate": "2026-09-02T20:17:37.033Z",
  "executiveSummary": "UpSignOn for Windows versions prior to 7.19.0 are susceptible to a sensitive data exposure vulnerability arising from insecure memory management practices.\nThe vulnerability allows local, unprivileged attackers to extract decrypted vault information directly from the process memory of UpSignOn.exe.\nEven when the application is in a locked state, sensitive credentials, including usernames, passwords, URLs, and TOTP secrets, remain resident in plaintext within the process heap.\nThis flaw represents a critical security risk for multi-user systems or environments where local attackers may obtain user-level access.\nBy leveraging the PROCESS_VM_READ access right, an adversary can perform memory dumping or live inspection to bypass the application's intended lockout security controls.\nSuccessful exploitation results in full compromise of the user's vaulted identity data without requiring administrative privileges.",
  "technicalDetails": "The vulnerability is rooted in the failure of the UpSignOn.exe process to effectively clear or encrypt sensitive data structures from system memory upon transitioning to a locked state.\nIn typical password manager architectures, sensitive data should ideally be zeroed out or reside in encrypted memory pages when the vault is locked to prevent memory-scraping attacks.\nIn the affected versions, the application maintains decrypted credentials within its volatile memory space, rendering them accessible as long as the process remains alive in the Windows operating system memory map.\nThe exploitation method relies on the Windows API call 'ReadProcessMemory'. Because the UpSignOn.exe process does not implement sufficient process-level protection, a local attacker with equivalent or higher user privileges can request a handle to the process using the PROCESS_VM_READ access mask.\nOnce the handle is obtained, the attacker can traverse the process's Virtual Address Space to locate the specific memory regions containing vaulted records. By scanning these regions for known data patterns or structure offsets associated with the application's internal data models, the attacker can recover cleartext fields.\nThe attack flow is as follows: 1) The attacker initiates an authenticated user session on the target host; 2) The attacker identifies the PID of the running UpSignOn.exe process; 3) The attacker utilizes a custom script or utility to attach to the target process; 4) The attacker invokes 'ReadProcessMemory' to dump the heap or inspect specific memory offsets where entry data is cached; 5) Sensitive credentials, including TOTP secrets and cleartext passwords, are parsed and exfiltrated from the dump.\nThe impact is total loss of confidentiality for the stored vault data. Because this occurs at the process memory level, it circumvents application-level GUI locking mechanisms, making the 'lock' functionality ineffective against local memory inspection. The exposure is confined to local attackers, as the vulnerability does not directly expose memory over a network; however, the impact is severe if the system is shared among multiple users or compromised via malware."
}