Microsoft CVE-2026-34773

The CVSS score of 4.7 with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N reflects a local attack vector requiring low privileges and high complexity to exploit, with high integrity impact but no confidentiality or availability impact. The integrity-focused impact aligns with registry hijacking-the attacker can modify registry entries but cannot directly read sensitive data or crash the system. The requirement for local access (AV:L) and low-level user privileges (PR:L) significantly constrains real-world exploitation, as attackers must first gain local system access. The high complexity (AC:H) suggests the attack requires specific conditions or non-obvious exploitation steps. However, the vulnerability is context-dependent: only applications that pass untrusted input (e.g., from command-line arguments, external files, or network sources) to setAsDefaultProtocolClient() are at risk; hardcoded protocol names are safe. The straightforward nature of the validation bypass and the potential for protocol hijacking (a notable privilege escalation or lateral movement technique) elevate practical concern for vulnerable applications, even though the CVSS base score is moderate.

An Electron-based application accepts a protocol name from a user-supplied configuration file or command-line argument and passes it directly to app.setAsDefaultProtocolClient(protocol). An attacker crafts a malicious protocol string such as 'test\..\protocolhandler' or uses registry path traversal syntax to cause the registry write to target a sibling subkey under HKCU\Software\Classes\ that belongs to a legitimate protocol handler (e.g., 'http' or 'mailto'). Upon the vulnerable application's next execution, the attacker's registry entry overwrites the legitimate handler, causing the hijacked protocol to launch the attacker's chosen executable instead of the original handler. No public exploit code has been identified at time of analysis, but the vulnerability is straightforward to exploit once untrusted input is identified in an application.