ZDI-26-565: Gen Digital CCleaner Link Following Local Privilege Escalation Vulnerability
A link-following flaw (CVE-2026-12410, CVSS 7.8) in Gen Digital CCleaner allows local privilege escalation after low-privileged code execution.
ZDI advisory ZDI-26-565 details a link following vulnerability in Gen Digital CCleaner that permits local privilege escalation. An attacker must first be able to run low-privileged code on the affected installation. ZDI rated the issue 7.8 on CVSS and assigned CVE-2026-12410.
- Local privilege escalation in Gen Digital CCleaner via link following.
- Requires prior low-privileged code execution on the system.
- CVSS 7.8; tracked as CVE-2026-12410 under ZDI-26-565.
- CVEs
- CVE-2026-12410
- Products
- CCleaner
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-12410 | Link following vulnerability in the Uninstaller component in CCleaner prior to 7.10.1464 on Windows allows a local, low-privileged attacker to escalate… | 7.8 | <1% |
From the original article
This vulnerability allows local attackers to escalate privileges on affected installations of Gen Digital CCleaner. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.