Maono Link CVE-2026-77827

Requires an existing local standard (non-admin) user account on a Windows system with Maono Link version prior to 4.0.80 installed and the MaonoAiServices service active. The core enabling condition is that C:\ProgramData\Maono grants write or modify permissions to standard user accounts - a non-default best-practice violation but present as shipped by the vendor. No network access is required; attack surface is limited to local interactive logon or Remote Desktop sessions. Exploitation also requires a service restart to load the planted payload, which may occur naturally on reboot or be induced by other means. The flaw does not affect systems where only a single admin account exists or where standard users have been explicitly denied write access to ProgramData subdirectories via group policy.

The CVSS 4.0 score of 8.4 (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) accurately reflects a low-complexity local attack requiring only a standard user account and no user interaction, yielding high confidentiality and integrity impact. EPSS data is not provided in the source intelligence. There is no CISA KEV listing and no public exploit code identified - no public exploit identified at time of analysis. Real-world risk is meaningful on shared Windows workstations (kiosks, shared creative suites, VDI environments) where multiple user accounts exist and Maono audio hardware is in use, as the escalation path is technically straightforward once local access is established. The niche consumer/prosumer deployment footprint of this audio software significantly limits broad enterprise exposure compared to a similar flaw in a widely-deployed service.

A standard local user account on a shared Windows workstation with Maono Link installed identifies that C:\ProgramData\Maono is writable by their account. The attacker places a malicious DLL or executable matching the name of a component loaded by the MaonoAiServices service, then waits for or induces a service restart (e.g., system reboot or application update trigger), causing their payload to execute at the service's elevated privilege level. No public exploit code is known at time of analysis, but the technique is well-understood and requires no specialized tooling beyond standard Windows file-write operations.