TotalAV CVE-2026-110746

Exploitation requires the attacker to already be an authenticated but unprivileged local user on a Windows host with TotalAV version ≤7.1.17 installed and its SYSTEM service running. The specific prerequisite is the ability to load IPC.dll and forge the gRPC IPC authentication token that the SYSTEM service trusts, then issue IPC commands to it. Limiting factors that reduce real-world risk: no network vector (AV:L - a prior local foothold is mandatory), no remote/unauthenticated path, and the issue is scoped to the TotalAV product being present; it cannot be triggered against hosts that do not run the vulnerable TotalAV service.

This is a credible local privilege-escalation issue rather than a remotely-wormable crisis. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) is internally consistent with the description: it requires LOCAL access (AV:L) by an already-authenticated but unprivileged user (PR:L), no user interaction, and yields total compromise (C:H/I:H/A:H) by executing code as NT AUTHORITY\SYSTEM - matching the SSVC 'Technical Impact: total' rating. Exploitation signals are moderate: SSVC lists Exploitation as 'poc' and a working exploit (TotalAV_LPE.c) is published, so publicly available exploit code exists, but there is NO CISA KEV listing and no EPSS score was provided in the input, so widespread opportunistic exploitation is not evidenced. SSVC 'Automatable: no' aligns with AV:L - this is not mass-exploitable over a network and requires a foot on the host first. Net: a real priority for endpoint-hardening teams running TotalAV (a SYSTEM-level escape with public PoC), but not an internet-facing emergency; prioritize patching where TotalAV is deployed, below any network-reachable unauthenticated RCEs. Note: the assigned CWE-22 (Path Traversal) sits awkwardly with the described root cause (forging a gRPC IPC authentication token) - verify the true weakness with the researcher/vendor advisory.

An attacker who already has a low-privileged foothold on a Windows host running TotalAV ≤7.1.17 (e.g. a standard user account or a compromised unprivileged process) loads IPC.dll, forges the gRPC IPC authentication token expected by the TotalAV SYSTEM service, and sends crafted IPC requests that cause the service to execute attacker-controlled code as NT AUTHORITY\SYSTEM. A public proof-of-concept (TotalAV_LPE.c) demonstrates the technique, lowering the skill barrier; because AV:L/AC:L, exploitation is reliable but requires prior local access.