EUVD-2026-54356
GHSA-5hmm-jf4c-7fwx
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector with low-privilege requirement matches the service IPC attack surface; no scope change as subsequent systems are unaffected per CVSS 4.0 SC/SI/SA:N.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
A security vulnerability has been detected in StableBit DrivePool 2.3.13.1687. This vulnerability affects unknown code of the file C:\Program Files\StableBit\DrivePool\DrivePool.Service.exe of the component DrivePoolService. Such manipulation leads to permission issues. The attack must be carried out locally. The exploit has been disclosed publicly and may be used.
AnalysisAI
Local privilege escalation in StableBit DrivePool 2.3.13.1687 allows a low-privileged local user to achieve high-impact compromise of confidentiality, integrity, and availability on the affected system. The vulnerability resides in DrivePool.Service.exe and stems from CWE-275 permission issues, with the publicly available exploit reference explicitly identifying insecure deserialization as the attack mechanism enabling escalation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated local user session on the target Windows machine - the attacker must be able to execute code locally with at least standard user privileges (PR:L in CVSS 4.0). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H scores at 7.1 and reflects a realistic local privilege escalation scenario: low attack complexity, no special configuration required beyond standard user access, no user interaction, and full impact across all three pillars. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A standard Windows user account on a machine running StableBit DrivePool 2.3.13.1687 crafts a malicious serialized payload and delivers it to the DrivePool.Service.exe process via its local IPC interface. The service, running with elevated privileges, deserializes the attacker-controlled data without adequate type or permission validation, triggering code execution in the service's security context - likely SYSTEM or LocalService. … |
| Remediation | No vendor-released patch has been identified at the time of this analysis - the available references do not include a StableBit security advisory or a patched version number. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all systems running StableBit DrivePool 2.3.13.1687, document local user accounts and access rights, and immediately restrict local logon privileges to essential personnel only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-275 – Permission Issues
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today