CCleaner EUVD-2026-53387

Exploitation requires a local, interactive or network-authenticated session on the Windows target system as a standard (low-privileged) user account. The attacker must have write access to the CCleaner application data directory path or the ability to replace it with an NTFS junction - a capability available to standard Windows users without elevated rights. The uninstallation of CCleaner must be triggered: if the attacker can initiate uninstallation themselves, exploitation is self-contained; if only administrators can uninstall, the attacker must plant the junction and wait for an administrator-initiated removal event. The vulnerability is strictly Windows-only (NTFS reparse point dependency) and constrained to the uninstallation workflow of CCleaner versions prior to 7.10.1464. Remote, unauthenticated exploitation is not possible. The attack is not viable on systems where CCleaner is not installed or where software removal is restricted to administrator-only processes with no user-writable paths involved.

The CVSS 3.1 score of 7.8 High with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is well-calibrated to the described behavior: local access is required (AV:L), no race conditions or special complexity is needed since the junction can be placed before triggering uninstall (AC:L), and only a low-privileged session is required (PR:L). The full C:H/I:H/A:H impact reflects SYSTEM-level arbitrary file manipulation. No EPSS data was provided in the intelligence, and the absence of a CISA KEV listing or confirmed public POC indicates limited observed exploitation as of analysis time, making this lower urgency than a remotely exploitable or actively weaponized flaw. From an SSVC perspective: exploitation requires local authenticated access and is not automatable at scale (not network-reachable), but technical impact is total. In enterprise endpoint environments where CCleaner is deployed on shared or managed workstations with standard-user accounts, this is a meaningful lateral privilege escalation step for a threat actor who already has local foothold. No conflicts between the CVSS vector and the vulnerability description were identified.

A low-privileged user on a Windows endpoint where CCleaner is installed replaces the CCleaner application data folder with a directory junction pointing to a sensitive SYSTEM-owned path, such as a Windows system configuration directory or a folder containing privileged executables. When the CCleaner uninstaller subsequently runs with SYSTEM integrity - whether triggered by the attacker or an administrator - it follows the junction and performs elevated file deletion or manipulation against the attacker-specified target, enabling the attacker to delete critical system files or overwrite binaries as a step toward full SYSTEM-level code execution. No public POC has been identified at time of analysis.