HP Sure Click CVE-2026-106177

Exploitation requires local code execution on a Windows host with HP Sure Click / HP Wolf Security (Enterprise, Wolf Security for Business, Wolf Pro Security, or Wolf Pro Security Edition) installed at a version below 4.4.33 (AV:L). Limiting factors are significant: the attacker must already hold elevated privileges (PR:H) and overcome a non-trivial triggering condition such as a memory-corruption race or precise heap state (AC:H), and no remote or network path exists. The description does not name a specific feature toggle or non-default configuration, but the kernel-mode driver component must be present and active, which it is in default installations of these products; verify the exact triggering surface against HP advisory hpsbhf04157.

This is a medium-severity local privilege escalation / code execution flaw (CVSS 6.4) whose real-world urgency is tempered by its exploitation prerequisites. The vendor CVSS vector CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H indicates a local attack vector with high attack complexity and high privileges required, yielding high confidentiality, integrity and availability impact within an unchanged scope. There is no KEV listing, no EPSS score, and no POC referenced in the provided data, so exploitation is not demonstrated - no public exploit identified at time of analysis. Notably, the PR:H rating is unusual for a privilege-escalation bug, since such flaws typically begin from an already-compromised low-privileged user (PR:L); this suggests either that a specific pre-existing elevated/configuration context is needed or a conservative vendor scoring - verify with HP's advisory. The combination of local-only access, high complexity, and high required privileges makes this a patch-on-normal-cadence item rather than an emergency, but the kernel-level code execution impact means it is a valuable post-compromise escalation primitive and should not be deferred indefinitely on HP-managed fleets.

An attacker who already has local, privileged access to a Windows endpoint running an unpatched HP Sure Click / HP Wolf Security build (prior to 4.4.33) triggers a heap-based buffer overflow in the product's kernel-mode component. By winning the required timing/condition window (reflected in AC:H), they corrupt kernel memory to execute arbitrary code at kernel privilege, fully compromising the host. No public exploit code is identified at time of analysis, and the attack requires local access rather than remote delivery.