EUVD-2026-31648
GHSA-7cww-6v7x-9gjw
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:M/U:X
Local-only attack requiring an authenticated session to reach the Named Pipe; impact is exclusively a service availability loss with no confidentiality or integrity effect.
Primary rating from Vendor (Acer).
CVSS VectorVendor: Acer
Lifecycle Timeline
2DescriptionCVE.org
A security vulnerability has been identified in Acer Care Center where the ACCSvc service creates a Named Pipe with a weak Security Descriptor. This vulnerability allows an authenticated local user to connect and send a specially crafted message (message type 0x03) to the pipe, causing the service to crash with exit code 1067 (ERROR_PROCESS_ABORTED). To mitigate this potential local service disruption, Acer requires users to update the software to the latest version.
AnalysisAI
Acer Care Center's ACCSvc service exposes a Named Pipe with an insufficiently restrictive Security Descriptor, enabling any authenticated local user to crash the service by sending a crafted IPC message of type 0x03, resulting in process termination with ERROR_PROCESS_ABORTED (exit code 1067). Versions 4.0 up to and including 4.00.3058 are confirmed affected. No public exploit has been identified at time of analysis; EPSS probability stands at 0.01% (2nd percentile), SSVC classifies exploitation as none, and there is no CISA KEV listing - placing this firmly in the low operational priority tier despite the Medium CVSS score.
Technical ContextAI
ACCSvc is a Windows background service within Acer Care Center (CPE: cpe:2.3:a:acer:care_center:*:*:*:*:*:*:*:*) that handles hardware monitoring and OEM support functions. It creates a Named Pipe as an inter-process communication (IPC) channel but assigns a Security Descriptor whose Discretionary Access Control List (DACL) does not restrict connections to privileged principals. This allows any authenticated local user to open a handle to the pipe and submit arbitrary message payloads. Message type 0x03 triggers a code path the service cannot safely handle, causing an uncontrolled process termination. CWE-269 (Improper Privilege Management) is the assigned root cause class; more precisely, the failure is the absence of least-privilege DACL enforcement on a privileged IPC endpoint - a Named Pipe access control misconfiguration rather than a logic flaw in the service's core functionality.
RemediationAI
Acer's primary remediation is to update Acer Care Center to the latest available version, as directed by the vendor advisory at https://community.acer.com/en/kb/articles/19668. The exact patched version number is not independently confirmed in the available data beyond the implied boundary that releases above 4.00.3058 contain the fix - verify the exact version in the advisory before deployment. Where an immediate update is not feasible, administrators can disable the ACCSvc service if Acer Care Center functionality is not operationally required, noting that doing so will remove hardware monitoring and OEM support features. Restricting local interactive logon rights to trusted accounts via Group Policy is a further compensating control, reducing the pool of users who can reach the Named Pipe, though this does not eliminate the underlying flaw.
More in Care Center
View allSame weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today