EUVD-2026-44895
GHSA-95hw-w6xx-75xp
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector and low-privileged local session required (AV:L, PR:L); no user interaction and low complexity; full C/I/A impact on the host with no scope change.
Primary rating from Vendor (ESET).
CVSS VectorVendor: ESET
Lifecycle Timeline
2DescriptionCVE.org
A local privilege escalation vulnerability in ESET Inspect Connector. The vulnerability was caused by improper authentication in an IPC channel.
AnalysisAI
Local privilege escalation in ESET Inspect Connector for Windows lets a low-privileged local user escalate to elevated (SYSTEM-level) privileges by abusing an improperly authenticated ALPC (Asynchronous Local Procedure Call) IPC channel. The affected component is the endpoint agent that links ESET Inspect (EDR) to protected Windows hosts; a non-privileged process can issue unauthenticated requests to a privileged service endpoint that fails to verify the caller. The issue was reported and fixed by ESET, is not listed in CISA KEV, and has no public exploit identified at time of analysis.
Technical ContextAI
The vulnerability lives in the inter-process communication surface of the ESET Inspect Connector, ESET's EDR sensor/agent for Windows that forwards telemetry and receives management commands. ESET's advisory identifies the transport as Windows ALPC (Advanced/Asynchronous Local Procedure Call), a high-performance kernel-mediated IPC mechanism used between client processes and privileged services. The root cause maps to CWE-269 (Improper Privilege Management): the privileged ALPC server endpoint does not properly authenticate the identity or privilege level of connecting clients, so a low-integrity local process can invoke functionality intended only for higher-privileged callers. Because ALPC ports are reachable by any local process that can open the named port, missing caller authentication collapses the security boundary between an ordinary user context and the SYSTEM-level service. The affected CPE is cpe:2.3:a:eset,_spol._s.r.o.:eset_inspect_connector, i.e. the Connector application component rather than the broader ESET endpoint suite.
RemediationAI
Patch available per vendor advisory: update ESET Inspect Connector for Windows to the fixed version referenced in ESET Customer Advisory ca8970 (https://support.eset.com/en/ca8970-eset-customer-advisory-local-privilege-escalation-via-unauthenticated-alpc-in-eset-inspect-connector-for-windows-fixed); the provided data does not include an exact fixed build number, so confirm the target version against that advisory before deployment. Because ESET manages agent versions centrally, roll the update through the ESET PROTECT/management console to all endpoints running the Connector rather than manually per host. As this is a local-only escalation, interim compensating controls should focus on limiting who can obtain a local session on affected hosts: enforce least-privilege on endpoints, restrict interactive/remote logon rights to trusted administrators, and monitor for unexpected local process activity interacting with ESET service endpoints - with the trade-off that these controls reduce but do not eliminate risk from any already-authenticated local user or malware running in a user context. Given the component IS the security agent, prioritize patching over relying on workarounds, since disabling the Connector would degrade EDR coverage.
WinRAR for Windows contains a path traversal vulnerability allowing crafted archives to execute arbitrary code, discover
The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5
The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7,
Heap-based buffer overflow in the Archive support module in ESET NOD32 before update 11861 allows remote attackers to ex
The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, Quick Heal (aka Cat QuickHeal) 11.00, Emsis
The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast!. Rated medium severity (CVSS 4.3), t
The RAR file parser in ClamAV 0.96.4, Rising Antivirus 22.83.00.03, Quick Heal (aka Cat QuickHeal) 11.00, G Data AntiVir
Local privilege escalation vulnerability potentially allowed an attacker to misuse ESET’s file operations to delete file
The ESET Personal Firewall NDIS filter (EpFwNdis.sys) driver in the Firewall Module Build 1183 (20140214) and earlier in
The esets_daemon service in ESET Endpoint Antivirus for macOS before 6.4.168.0 and Endpoint Security for macOS before 6.
The ESET AV parsing engine allows virus-detection bypass via a crafted BZ2 Checksum field in an archive. Rated critical
Improper validation of the server’s certificate chain in secure traffic scanning feature considered intermediate certifi
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today