KDE Kleopatra CVE-2026-41527

Exploitation requires that KDE Kleopatra is actively running on the target Windows machine at the time of the attack - the vulnerable KUniqueService code path activates only when a second Kleopatra invocation is initiated while an instance is already running, making a live Kleopatra process a hard prerequisite. The attacker must have local access to the Windows system (AV:L); no pre-existing elevated privileges are required (PR:N per CVSS), so any standard local user account is sufficient to attempt the attack. Attack complexity is rated High (AC:H), meaning exploitation is not trivially repeatable and likely depends on precise control of IPC interaction sequencing or specific knowledge of the flawed logic branch in KUniqueService. The vulnerability is Windows-specific and does not affect Kleopatra on Linux, macOS, or other KDE-supported platforms. Exploitation is bounded by the requirement for physical or remote desktop local access, the hard dependency on an actively-running Kleopatra instance, and the high attack complexity that prevents straightforward or automated exploitation.

The CVSS 6.9 vector (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L) correctly signals a local-only, high-complexity attack that requires no prior privileges - any unprivileged local Windows account may attempt exploitation without needing an existing foothold at an elevated level. The C:H/I:H impact dimensions are credible given Kleopatra manages private keys and certificate material, but the scope is unchanged (S:U), meaning compromise does not automatically cascade to the broader system. Real-world risk is substantially dampened by three converging signals: EPSS at 0.01% (percentile 2%), SSVC exploitation status of none, and no CISA KEV listing. The SSVC 'total' technical impact label reflects the sensitivity of Kleopatra's data rather than breadth of host compromise. There is no conflict between the CVSS vector and the description - the local attack vector is consistent with the IPC abuse scenario described. This vulnerability is a genuine but low-urgency issue; organizations where Kleopatra manages high-value key material (e.g., code-signing or organizational S/MIME keys) should treat it with elevated priority relative to the raw CVSS score, while general enterprise environments can schedule patching in normal maintenance cycles given the absence of observed exploitation.

A local, unprivileged attacker on a shared Windows workstation where Kleopatra is actively running triggers a second invocation of the application, causing KUniqueService to route the new launch request to the existing instance via IPC; by crafting the IPC interaction to exploit the control-flow flaw in KUniqueService, the attacker causes the running Kleopatra process to act on their behalf with the privileges of the original Kleopatra user, potentially exposing private GnuPG keys or S/MIME certificates stored in that user's keyring. No public exploit code has been identified at time of analysis, and the AC:H rating indicates reliable exploitation requires specific knowledge of the IPC defect and favorable system conditions rather than a straightforward, repeatable technique.