EUVD-2026-31619
GHSA-x6vp-3m75-76c9
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated local user abuses a local Named Pipe with low complexity and no user interaction (AV:L/AC:L/PR:L/UI:N), gaining SYSTEM code execution for full C/I/A impact with no scope change.
Primary rating from Vendor (Acer).
CVSS VectorVendor: Acer
Lifecycle Timeline
3DescriptionCVE.org
NitroSense 3.x before 3.01.3052 contains Local Privilege Escalation (LPE) vulnerability.The program exposes a Windows Named Pipe that uses a custom protocol to invoke internal functions. However, this Named Pipe is misconfigured, allowing any authenticated local user to execute arbitrary code with NT AUTHORITY\SYSTEM privileges and to delete arbitrary files with SYSTEM privileges. By leveraging this, an attacker can execute arbitrary code on the target system with elevated privileges.
AnalysisAI
Local privilege escalation in Acer NitroSense 3.x before 3.01.3052 allows any authenticated local user to run arbitrary code as NT AUTHORITY\SYSTEM and delete arbitrary files with SYSTEM rights by abusing a misconfigured Windows Named Pipe that exposes internal functions through a custom protocol. There is no public exploit identified at time of analysis and EPSS exploitation probability is negligible (0.02%), but SSVC rates technical impact as total, making this a high-value local escalation on affected Acer gaming laptops. Authentication requirements per the CVSS 4.0 vector are PR:L, so a low-privileged but authenticated local account is sufficient.
Technical ContextAI
NitroSense is Acer's system-management and hardware-control utility bundled on Nitro/Predator gaming laptops; it runs a privileged background service that clients communicate with over a Windows Named Pipe using a custom protocol to invoke internal functions. The vulnerability stems from the pipe's access-control/security-descriptor being misconfigured so that any authenticated local user, rather than only the privileged service or administrators, can connect and invoke those SYSTEM-level functions. Although classified as CWE-22 (Path Traversal) - reflected in the arbitrary-file-delete-with-SYSTEM primitive where attacker-controlled paths are not properly constrained - the root cause is really an over-permissive IPC endpoint that exposes powerful operations to unprivileged callers, combining path traversal with a broken privilege boundary. The single affected component is identified in CPE as cpe:2.3:a:acer:nitrorsense_v3:*:*:*:*:*:*:*:* (NitrorSense V3).
RemediationAI
Vendor-released patch: update NitroSense to version 3.01.3052 or later, which corrects the Named Pipe misconfiguration; follow the vendor instructions in Acer's advisory at https://community.acer.com/en/kb/articles/19652 (see also https://nvd.nist.gov/vuln/detail/CVE-2026-9489). Because exploitation requires an authenticated local session, interim compensating controls where immediate patching is not possible include restricting interactive local logon to trusted users, uninstalling or disabling the NitroSense service on systems that do not need its hardware-control features (trade-off: loss of fan/performance/keyboard-lighting management), and monitoring for unexpected processes spawned by the NitroSense service or anomalous connections to its Named Pipe. If feasible, applying a tightened security descriptor/ACL to the pipe would help, but this is fragile and may break the client-service communication, so upgrading to 3.01.3052 remains the reliable fix.
More in Nitrorsense V3
View allSame weakness CWE-22 – Path Traversal
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today