DFIR-ORC CVE-2026-11958

The attacker must already have local code execution as a standard user on the target Windows host with write access to C:\Windows\Temp (the default ACL grants Users write-but-not-list permission, which is sufficient to drop a DLL with a known name). Exploitation further requires that an administrator subsequently launches DFIR-ORC version 10.2.7 or earlier on that same host so it extracts into C:\Windows\Temp - without that triggering event the malicious DLL is never loaded. Exploitation is limited by: prior local access being required (AV:L, PR:L), the need for an administrator to execute DFIR-ORC out-of-band (UI:P / AT:P), the attacker correctly guessing the DLL name DFIR-ORC's loader will search for, and the host not yet running v10.3.0, which restricts the extraction-directory ACLs.

The provided CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:P) correctly characterizes this as a local, user-interaction-dependent escalation rather than a remote threat, but the VC/VI/VA:H plus SC/SI/SA:H impacts produce a base score of 7.3 because the outcome is full administrative compromise of the host. There is no EPSS score, no CISA KEV listing, and no public POC referenced, so realistic risk is moderate and bounded to environments where DFIR-ORC is actually deployed - primarily incident response engagements on Windows endpoints. The practical exposure window is the moment a responder runs DFIR-ORC on a host where an attacker already has a foothold; in that narrow scenario the attack is reliable and high-impact, but the attacker must already have a low-privileged shell, which limits opportunistic exploitation. AT:P (attack requirements present) and UI:P (passive user interaction) honestly reflect that the attacker must pre-stage the DLL and then wait for an out-of-band trigger.

A low-privileged attacker who has already landed on a Windows endpoint drops a malicious DLL named after one of DFIR-ORC's expected dependencies into C:\Windows\Temp and waits. When an incident responder later runs DFIR-ORC (typically as administrator) to triage the host, the framework extracts itself into the same directory and loads the attacker's DLL, executing arbitrary code with administrator privileges. No public exploit identified at time of analysis, but the technique is a well-known DLL search-order hijack pattern and is straightforward to weaponize.