Sublime Text CVE-2026-7006

Requires an existing unprivileged local account on a Windows host with Sublime Text (v4 ≤ Build 4192 or v3 ≤ Build 3207) installed, plus write access to the update staging directory under %LOCALAPPDATA%. Exploitation depends on the update staging mechanism being used and, critically, on a higher-privileged user subsequently launching the application (UI:P - passive user interaction by the victim). Limiting factors: no remote vector (local only), attacker needs a prior foothold (PR:L), the payload only fires when an elevated user runs the app, and the read-only trick is needed to bypass installer cleanup. Not exploitable against default single-user setups where no higher-privileged user ever launches the editor.

This is a genuine but conditional local privilege-escalation issue rather than a mass-exploitation threat. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H) is consistent with the description: the attacker must already have an unprivileged local foothold (PR:L), acts only locally (AV:L), and must wait for a higher-privileged user to launch Sublime Text (UI:P, passive). The 7.0 score is driven entirely by high technical impact once the DLL executes as the elevated user, not by ease of reach. POC/exploit code is publicly available (VulnCheck advisory plus a gist), which raises practical risk for targeted local attacks and post-compromise privilege escalation, but there is no CISA KEV listing and no EPSS score in the provided data, so there is no evidence of widespread active exploitation. No SSVC decision data was supplied. Net: treat as a real patch priority on multi-user Windows hosts and shared workstations where Sublime Text is installed and an elevated user is expected to run it, but it is not an internet-facing or wormable issue. No signals conflict; the local-only vector is confirmed by both CVSS and the description.

An unprivileged local user drops a malicious DLL into the user-writable update staging directory under %LOCALAPPDATA%, sets it read-only so the installer's cleanup routine skips it, then waits for the elevated update process to copy it into the protected installation directory. When any higher-privileged user later launches Sublime Text, the planted DLL loads and executes arbitrary code in that user's context. Public exploit code exists (VulnCheck advisory and a published gist), lowering the barrier to reproduction.