EUVD-2026-54354
GHSA-3j3c-5632-g52j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local low-privilege account
-
DeliveryAccess ScannerService IPC endpoint
-
ExploitSend crafted deserialization payload
-
ExecutionTrigger CWE-275 permission issue in Scanner.Service.exe
-
PersistExecute code in high-privilege service context
-
ImpactAchieve full local system compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V8 - Authorization Permission management
|
| Exploitation Conditions | Exploitation requires local authenticated access to the Windows system with at minimum a low-privilege user account (PR:L confirmed by CVSS 4.0 vector). StableBit Scanner must be installed and the ScannerService (Scanner.Service.exe) must be running, which is the default state after installation. No additional non-default configuration is required (AT:N in CVSS 4.0 confirms no attack prerequisites beyond local access). No user interaction is needed. Exploitation is strictly local - remote network exploitation is not possible. What limits exploitation: physical or RDP/terminal-session access to the target machine, and the presence of the StableBit Scanner software, which is a niche disk monitoring tool with a limited deployment footprint. |
| Impact | The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H) scores 7.1 and carries E:P (proof-of-concept exploit confirmed), indicating a meaningful real-world risk for environments where StableBit Scanner is deployed. The local attack vector (AV:L) substantially limits the threat surface - remote exploitation is not possible, and an attacker must first obtain local authenticated access. However, the low privilege requirement (PR:L) means any standard domain or local user account is sufficient, which is realistic in multi-user workstation or server environments. The CVSS 4.0 score of 7.1 with E:P elevates the practical urgency over a purely theoretical finding. No EPSS score is available in the provided data, and CISA KEV status is absent, suggesting no confirmed widespread exploitation campaign. The PoC/CWE discrepancy - the description cites CWE-275 (permission issues) while the PoC title invokes insecure deserialization - is unresolved and should be confirmed against vendor analysis; the actual exploitation path may be a deserialization sink within a permissively-accessible service endpoint, which would make both characterizations simultaneously correct. |
| Exploit ScenarioDerived | A low-privileged Windows user on a workstation or server with StableBit Scanner installed sends a crafted payload to the ScannerService IPC interface (likely a named pipe or local COM endpoint) that triggers insecure deserialization within Scanner.Service.exe. Because the service runs under a high-privilege account and improperly enforces caller permissions, the deserialized payload executes in the service's security context, granting the attacker SYSTEM-level or equivalent privilege. A public PoC is available at the referenced URL, lowering the skill bar required for exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 07, 2026
Local privilege escalation in StableBit Scanner 2.6.13.4088 allows a low-privileged Windows user to exploit permission misconfigurations in Scanner.Service.exe - the Windows service component of the disk health monitoring tool - to achieve high confidentiality, integrity, and availability impact on the local system. The exploit reference titles the technique as 'local privilege escalation via insecure deserialization,' suggesting the ScannerService's IPC or communication surface deserializes attacker-controlled data without adequate permission enforcement. No public exploit identified at time of analysis is incorrect here - publicly available exploit code exists per VulDB and the referenced PoC page, though no CISA KEV listing confirms active in-production exploitation.
Earlier versions of this analysis (1)
Local privilege escalation in StableBit Scanner 2.6.13.4088 allows a low-privileged local user to gain elevated system access by exploiting insecure permission handling in the ScannerService component (Scanner.Service.exe). The root mechanism, confirmed by the public exploit reference, is insecure deserialization combined with incorrect permission assignment (CWE-275) within the Windows service process, which likely runs under an elevated account. A proof-of-concept exploit is publicly available per VulDB and the exploit page at winslow1984.com; no CISA KEV listing was found, so active exploitation in the wild has not been independently confirmed.
RemediationAI
No vendor-released patch or exact fix version is identified in the available data - all references point to VulDB and a third-party PoC page, with no StableBit vendor advisory. Organizations running StableBit Scanner 2.6.13.4088 should check the StableBit website directly for an updated release. As an interim compensating control, restrict local logon access to systems running StableBit Scanner to only trusted administrators, reducing the pool of principals who can reach the vulnerable service endpoint; this trades user convenience for attack surface reduction. Additionally, review and harden the ACL on the Scanner.Service.exe named pipe or IPC endpoint using tools such as Sysinternals AccessChk or sc sdshow to identify and remove overly permissive access granted to low-privilege users. If the deserialization vector is confirmed, blocking local untrusted process interaction with the service via Windows Firewall's local rules or AppLocker policies on the communication channel can serve as a stop-gap. Monitor for anomalous child processes spawned from Scanner.Service.exe as an indicator of exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
StableBit Scanner is a Windows disk health and surface scanning utility that installs a background Windows service (Scanner.Service.exe) located at C:\Program Files (x86)\StableBit\Scanner\Service\. As a Windows service, this process typically runs under a high-privilege account (e.g., SYSTEM or LocalService). CWE-275 covers Incorrect Privilege Assignment, meaning the service either grants excessive permissions to its IPC endpoint, named pipe, COM interface, or configuration artifacts - allowing a low-privileged user to interact with the high-privilege service process in an unauthorized manner. The PoC reference explicitly names 'insecure deserialization' as the mechanism, which would mean the service deserializes caller-supplied data (via IPC, named pipe, or local socket) without validating the caller's privilege level, enabling privilege escalation. The CPE cpe:2.3:a:stablebit:scanner:*:*:*:*:*:*:*:* uses a wildcard version field, though EUVD data pins the confirmed affected build to 2.6.13.4088.
Know when Scanner gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Local vector confirmed; low privilege sufficient; no scope change as impact is contained to vulnerable system; full CIA impact consistent with privilege escalation to service account.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A weakness has been identified in StableBit Scanner 2.6.13.4088. This affects an unknown part of the file C:\Program Files (x86)\StableBit\Scanner\Service\Scanner.Service.exe of the component ScannerService. This manipulation causes permission issues. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks.
Executive ViewAI
StableBit Scanner 2.6.13.4088 contains a local privilege escalation vulnerability (CVE-2026-19190, CVSS 7.1) with publicly available exploit code, allowing low-privileged Windows users to gain complete system control through insecure deserialization in the Scanner.Service.exe component. Organizations running this disk monitoring tool face risk of full system compromise if users gain local access. With no vendor patch currently available, immediate compensating controls are critical to prevent exploitation.
No vendor-released patch identified at time of analysis. Interim mitigations include: restricting file system and registry permissions on Scanner.Service.exe to prevent low-privileged user access to IPC endpoints; configuring the service account to run with minimum required privileges and disabled network access; implementing endpoint detection and response (EDR) monitoring tuned to detect deserialization-based privilege escalation attacks; disabling StableBit Scanner on systems where disk health monitoring is not mission-critical; and applying Windows security hardening policies to restrict privilege escalation vectors. Consider temporary service shutdown on high-value targets until patches are released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB