EUVD-2026-37877Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attacker with a standard user account (AV:L, PR:L) drops a DLL and waits for an admin to run DFIR-ORC (UI:R); successful load yields admin code execution crossing a privilege boundary (S:C) with full CIA impact.
Primary rating from Vendor (INCIBE).
CVSS VectorVendor: INCIBE
Lifecycle Timeline
3DescriptionCVE.org
Local privilege escalation by loading DLLs from a shared temporary directory in ANSSI’s DFIR-ORC, versions 10.2.7 and prior. An attacker with prior access to the system, can place a malicious DLL in C:\Windows\Temp and wait for the application to be executed. Because DFIR-ORC is extracted and executed from that location with administrative privileges, the malicious library can be loaded automatically, allowing the attacker to gain administrator privileges on the affected machine.
AnalysisAI
Local privilege escalation in ANSSI's DFIR-ORC versions 10.2.7 and prior allows a low-privileged local user to gain administrator rights by planting a malicious DLL in C:\Windows\Temp, which the tool loads automatically when extracted and executed from that shared directory. The flaw is a classic uncontrolled search path (CWE-427) issue and was reported by INCIBE; no public exploit identified at time of analysis and the CVE is not in CISA KEV. The vendor has shipped a fix in DFIR-ORC v10.3.0, which adds ACL hardening on extraction directories.
Technical ContextAI
DFIR-ORC is an open-source digital forensics and incident response collection framework maintained by ANSSI (the French national cybersecurity agency), commonly run by responders with administrative privileges to triage Windows hosts. On execution, the embedded binaries are extracted into C:\Windows\Temp - a world-writable directory by default - and then launched. CWE-427 (Uncontrolled Search Path Element) applies because the loader resolves dependent DLLs from that same writable extraction path, so any pre-staged DLL with a matching name is loaded into a process running as administrator. The affected component is identified by CPE cpe:2.3:a:anssi:dfir-orc:*:*:*:*:*:*:*:*, and the v10.3.0 release notes explicitly call out new ACL checks on DFIR-ORC related files and non-inherited, restricted ACLs on output directories - confirming the temp-directory permission model as the root cause.
RemediationAI
Vendor-released patch: upgrade to DFIR-ORC v10.3.0 or later, which restricts ACLs on output and extraction directories to the current user and administrators and adds explicit ACL checks on DFIR-ORC related files (see https://github.com/DFIR-ORC/dfir-orc/releases/tag/v10.3.0 and the INCIBE advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/local-privilege-escalation-anssis-dfir-orc). Until the upgrade is rolled out, only execute DFIR-ORC on hosts where you have first verified that C:\Windows\Temp does not contain unexpected DLLs, or override the extraction location to a freshly created directory whose ACLs grant write access only to SYSTEM and Administrators - note that changing the working directory may break embedded configuration assumptions and should be tested. As an operational compensating control, prefer running DFIR-ORC from removable or read-only media on a clean account rather than re-using a host where an attacker may have already staged files, accepting the trade-off of slower collection.
Same weakness CWE-427 – Uncontrolled Search Path Element
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today