PT-2026-50662 · Anssi · Dfir-Orc

Nicolas Rodrigues + 1 · Publicado 2026-06-18 · Atualizado 2026-06-18 · CVE-2026-11958

NVD

CVSS v4.0

7.3

Alta

Vetor base

AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Local privilege escalation by loading DLLs from a shared temporary directory in ANSSI’s DFIR-ORC, versions 10.2.7 and prior. An attacker with prior access to the system, can place a malicious DLL in C:WindowsTemp and wait for the application to be executed. Because DFIR-ORC is extracted and executed from that location with administrative privileges, the malicious library can be loaded automatically, allowing the attacker to gain administrator privileges on the affected machine.

Correção

Uncontrolled Search Path Element

Enumeração de Fraquezas

CWE-427

Identificadores relacionados

CVE-2026-11958

Produtos afetados

Dfir-Orc

Referências · 3

• https://github.com/DFIR-ORC/dfir-orc/releases/tag/v10.3.0 · Correção, Aviso do Fabricante
• https://incibe.es/en/incibe-cert/notices/aviso/local-privilege-escalation-anssis-dfir-orc · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-11958 · Nota de Segurança