EUVD-2026-24513Severity by source
AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Local-only IPC attack with no prior privileges needed; AC:H reflects specific invocation-timing and IPC crafting requirement; C:H/I:H reflects private key access potential; S:U as compromise stays within Kleopatra process boundary.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
KDE Kleopatra before 26.08.0 on Windows allows local users to obtain the privileges of a Kleopatra user, because there is an error in the mechanism (KUniqueService) for ensuring that only one instance is running.
AnalysisAI
Privilege escalation in KDE Kleopatra before 26.08.0 on Windows allows any local user to assume the operating system privileges of a currently-running Kleopatra process by exploiting a control-flow defect in the KUniqueService single-instance enforcement mechanism. The CVSS 6.9 rating reflects high confidentiality and integrity impact - access to private cryptographic keys and certificates is plausible - but is substantially offset by the local-only attack vector and high complexity (AC:H). No public exploit code has been identified and SSVC confirms exploitation is currently none, with an EPSS of 0.01% placing this in the bottom 2% of CVEs by exploitation likelihood; a vendor patch at 26.08.0 is available via the April 2026 KDE security advisory.
Technical ContextAI
KDE Kleopatra is a certificate manager and universal cryptographic GUI that serves as the primary front-end for GnuPG (OpenPGP) and S/MIME operations, distributed on Windows as part of the Gpg4win package. The affected component is KUniqueService, a KDE framework mechanism that enforces single-instance application behavior by detecting an already-running process and routing subsequent launch requests to it via an inter-process communication (IPC) channel rather than spawning a second instance. CWE-670 (Always-Incorrect Control Flow Implementation) identifies the root cause class: the control flow governing how KUniqueService processes incoming IPC requests is fundamentally flawed, creating a privilege confusion path where a local actor can trick the running Kleopatra instance into treating a crafted IPC interaction with attacker-controlled authority. The CPE string cpe:2.3:a:kde:kleopatra:*:*:*:*:*:*:*:* covers all Kleopatra versions; the EUVD scopes the vulnerable range as 0 through below 26.08.0. The upstream fix is recorded at commit 73471abb92d99c56354adb582bfaec2764c22b79 in the KDE Kleopatra repository.
RemediationAI
Upgrade to KDE Kleopatra 26.08.0 or later, which resolves the KUniqueService control-flow defect. The KDE security advisory is published at https://kde.org/info/security/advisory-20250408-1.txt, the upstream fix commit is available at https://commits.kde.org/kleopatra/73471abb92d99c56354adb582bfaec2764c22b79, and release packages are listed at https://github.com/KDE/kleopatra/releases. For organizations that cannot patch immediately, the most effective compensating control is to ensure Kleopatra is not left running unattended in shared or multi-user Windows sessions, since the attack requires an active Kleopatra instance to target via KUniqueService - terminating Kleopatra when not in active use eliminates the attack surface entirely until patching is feasible. Additionally, restricting local user access to Windows workstations that run Kleopatra with high-value key material (via Windows account controls or session isolation) reduces the pool of potential local attackers who can attempt the IPC manipulation.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today