Which versions of Razer RzUpdateService are affected by CVE-2026-18606?

Razer RzUpdateService 1.10.14.0 contains a local privilege escalation vulnerability enabling low-privileged users to gain SYSTEM-level access through Named Pipe manipulation.

Is there a public PoC exploit available for CVE-2026-18606?

Yes, a public proof-of-concept exploit is available for CVE-2026-18606. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-18606?

Within 24 hours, complete an asset inventory of all systems running Razer RzUpdateService 1.10.14.0 and restrict file system access to the Named Pipe Handler component, blocking write permissions for non-administrator accounts. Within 7 days, uninstall or disable RzUpdateService on systems where Razer hardware is not operationally necessary; for systems requiring the service, implement strict local user privilege boundary controls and enforce application whitelisting to prevent exploitation. Within 30 days, establish continuous monitoring for vendor patch releases to RzUpdateService, evaluate migration to alternative peripheral vendors where feasible to reduce attack surface, and deploy endpoint detection controls to identify exploitation attempts.

Razer RzUpdateService CVE-2026-18606

Q: What is the CVSS score of CVE-2026-18606?

CVE-2026-18606 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-52351 HIGH

Improper Privilege Management (CWE-269)

2026-08-03 VulDB

GHSA-75gv-422j-4v8h

Privilege Escalation Rzupdateservice Razer

7.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.1 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local-only vector (AV:L), low-privilege account required (PR:L), no user interaction needed; scope unchanged (S:U) consistent with CVSS 4.0 SC:N - impact confined to local machine.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Aug 03, 2026 - 17:48 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 03, 2026 - 17:37 vuln.today

cvss_changed

CVSS changed

Aug 03, 2026 - 17:37 NVD

8.5 (HIGH) 7.1 (HIGH)

Analysis Generated

Aug 03, 2026 - 17:11 vuln.today

CVE Published

Aug 03, 2026 - 16:15 cve.org

HIGH 8.5

DescriptionCVE.org

A weakness has been identified in Razer RzUpdateService 1.10.14.0. Affected by this vulnerability is an unknown functionality of the file C:\Program Files (x86)\Razer\RzUpdateEngineService\RzUpdateService.exe of the component Named Pipe Handler. Executing a manipulation of the argument lpThreadParameter can lead to improper privilege management. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.

AnalysisAI

Privilege escalation in Razer RzUpdateService 1.10.14.0 allows a local low-privileged user to gain SYSTEM-level access by manipulating the lpThreadParameter argument processed by the service's Named Pipe Handler. The service, which runs at elevated Windows privilege, fails to enforce proper privilege boundaries when handling named pipe input (CWE-269), enabling a local user to leverage the service's execution context against the underlying system. A public proof-of-concept is confirmed available; the vulnerability is not currently listed in CISA KEV, though the low attack complexity combined with the published POC elevates real-world risk in environments with Razer hardware deployed.

Technical ContextAI

RzUpdateService (CPE: cpe:2.3:a:razer:rzupdateservice:*:*:*:*:*:*:*:*) is Razer's hardware driver update engine, installed as a privileged Windows service on systems running Razer peripheral software, with the binary at C:\Program Files (x86)\Razer\RzUpdateEngineService\RzUpdateService.exe. The vulnerability exists in the service's Named Pipe Handler - Named Pipes are a Windows IPC mechanism that allow processes to exchange data with a service; when the service runs as SYSTEM and exposes a pipe accessible to lower-privileged users, it becomes an attractive local escalation target. The lpThreadParameter argument is a pointer value typically supplied to Windows thread creation APIs (e.g., CreateThread), and its mishandling indicates the service passes or acts on attacker-controlled data within a privileged execution context without adequate validation. CWE-269 (Improper Privilege Management) identifies the root cause as a failure to restrict the privilege level under which operations triggered by this argument execute, rather than a classic memory corruption flaw.

RemediationAI

No vendor-released patch has been identified at time of analysis - remediation version not independently confirmed. Until Razer issues an official fix, the most effective compensating control is to stop and disable the RzUpdateService Windows service, which eliminates the named pipe attack surface entirely: run 'sc stop RzUpdateService && sc config RzUpdateService start=disabled' from an elevated prompt. The trade-off is that automatic Razer software and driver updates will no longer function. As an alternative, restrict named pipe access using Windows security descriptor policies to limit which accounts can connect to the service's pipe endpoint, preventing low-privileged users from interacting with it while preserving service functionality - this requires identifying the pipe name via tools such as Process Monitor or Pipelist. In high-security environments where Razer peripherals are not required, consider uninstalling Razer software entirely. Monitor for patch availability via https://vuldb.com/vuln/385529 and the exploit writeup at https://opcodic.notion.site/Privilege-Escalation-via-Insecure-Named-Pipe-in-RzUpdateService-2d88e7fec518803fa5decf10fb0e1e27.