Microsoft CVE-2026-34768

The CVSS v3.1 score of 3.9 (Low) reflects the constrained attack vector and prerequisites. The vector AV:L (Local), AC:H (High Complexity), PR:H (High Privilege required), and UI:N indicates this requires local system access and high-privilege credentials, significantly limiting real-world exploitability. The EPSS score is not provided, but the low CVSS and multiple preconditions suggest limited practical exploitation probability. Notably, the vulnerability requires the application to be installed in a non-standard location with spaces in the path, AND ancestor directories must be writable by the attacker-conditions that contradict default Windows security posture where standard system directories (Program Files, ProgramData) are write-protected for standard users. This is a privilege-escalation vector for unprivileged users on misconfigured systems, not a broad-reach vulnerability. The presence of a fix across four release branches indicates vendor acknowledgment, but the narrow exploit window and non-default preconditions reduce this from a critical priority to a situational fix.

An attacker with local access to a Windows system where an Electron application is installed to a path containing spaces (e.g., 'C:\Custom Install Folder\My App\app.exe') and the 'C:\Custom Install Folder' directory is world-writable discovers this misconfiguration. The attacker places a malicious executable named 'My.exe' in the Custom Install Folder directory. When the user logs in, Windows reads the unquoted registry entry 'C:\Custom Install Folder\My App\app.exe', parses it as 'C:\Custom Install Folder\My.exe' (truncating at the space), and executes the attacker's payload instead of the legitimate application. No public exploit code is identified at the time of analysis; exploitation requires local system access and favorable but non-default configuration conditions.