Razer RzUpdateService CVE-2026-18606

Exploitation requires a local interactive or remote desktop session on a Windows system running Razer RzUpdateService 1.10.14.0, with the attacker holding at minimum a low-privileged local or domain user account (CVSS 4.0 PR:L - unauthenticated or guest-level access is insufficient). No special system configuration is required beyond a default Razer software installation with RzUpdateService in a running state. The named pipe must be accessible to the standard user account, which is typical in default Razer deployments. Limiting factors include: (1) exploitation is strictly local - no remote network vector (AV:L); (2) a valid user session is required (PR:L); (3) RzUpdateService must be installed and actively running; (4) no impact extends beyond the local machine (SC:N/SI:N/SA:N per CVSS 4.0). This vulnerability does not directly enable remote exploitation or lateral movement, but it is a reliable escalation step in a multi-stage attack chain following initial access.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) with a score of 7.1 characterizes this as a low-complexity local escalation requiring only a standard user account - no attack prerequisites and no user interaction. Vulnerable-system impact is full across confidentiality, integrity, and availability (VC:H/VI:H/VA:H), while subsequent-system impact is absent (SC:N/SI:N/SA:N), confirming exploitation is confined to the local host. The CVSS 4.0 threat metric E:P confirms a proof-of-concept is present in the scoring, consistent with the public writeup at opcodic.notion.site. No EPSS data was provided in the input, so exploitation probability cannot be quantified. The vulnerability is not in CISA KEV, suggesting no confirmed mass exploitation at time of analysis. The primary real-world risk profile is as a post-initial-access privilege escalation primitive: an attacker who has obtained any local user account on a Windows machine with Razer software can reliably escalate to SYSTEM. In enterprise or gaming-lab environments with shared workstations and Razer peripherals, this is a meaningful lateral-movement enabler. No vendor patch has been identified, which materially increases urgency. The CPE wildcard version specifier in the NVD entry suggests versions beyond 1.10.14.0 may also be affected and should be verified with Razer.

A standard domain user on a shared Windows workstation equipped with Razer peripherals connects to the RzUpdateService named pipe using the publicly available proof-of-concept and submits a crafted lpThreadParameter payload. The service, running as SYSTEM, processes the argument without enforcing privilege boundaries, resulting in arbitrary code execution in the SYSTEM context. The attacker now holds full local administrative control, enabling credential dumping, persistence installation, or lateral movement via harvested credentials.