Which versions of DeepCool DisplayService are affected by EUVD-2026-54358?

DeepCool DisplayService on Windows contains a privilege escalation vulnerability enabling any local user to gain SYSTEM-level access without authentication.

Is there a public PoC exploit available for EUVD-2026-54358?

Yes, a public proof-of-concept exploit is available for EUVD-2026-54358. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2026-54358?

Within 24 hours, inventory all Windows systems running DeepCool DisplayService 1.2.12 to establish organizational scope and identify production systems. By day 7, implement compensating controls including uninstalling or disabling the service where operationally feasible, enforcing least-privilege user accounts, and deploying endpoint detection and response (EDR) tools configured for privilege escalation detection. Within 30 days, establish vendor communication channels to track patch availability and define a rapid deployment strategy; meanwhile, maintain strict access controls, monitor for exploitation indicators, and escalate any suspicious privilege escalation attempts.

DeepCool DisplayService EUVD-2026-54358

Q: What is the CVSS score of EUVD-2026-54358?

EUVD-2026-54358 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-19192 HIGH

Improper Access Control (CWE-284)

2026-08-07 VulDB

GHSA-h4hh-g898-g875

Authentication Bypass Displayservice

7.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.1 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Local attack requiring a low-privileged session; scope changes because exploitation elevates from user to SYSTEM security context.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Aug 07, 2026 - 05:32 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 07, 2026 - 05:22 vuln.today

cvss_changed

CVSS changed

Aug 07, 2026 - 05:22 NVD

8.5 (HIGH) 7.1 (HIGH)

Analysis Generated

Aug 07, 2026 - 04:45 vuln.today

CVE Published

Aug 07, 2026 - 03:45 cve.org

HIGH 8.5

DescriptionCVE.org

A vulnerability was detected in DeepCool DisplayService 1.2.12. This issue affects some unknown processing of the file C:\DeepCool\resources\service\x64\DeepCoolDisplayService.exe. Performing a manipulation results in improper access controls. The attack must be initiated from a local position. The exploit is now public and may be used.

AnalysisAI

DeepCool DisplayService 1.2.12 on Windows exposes an unauthenticated LocalSystem-level named pipe control channel that any low-privileged local user can connect to and manipulate, enabling full privilege escalation to SYSTEM. The root cause is CWE-284 (Improper Access Control) - the service's IPC channel enforces no caller authentication or ACL verification. A public proof-of-concept is available per VulDB and a researcher's writeup; the vulnerability is not currently listed in CISA KEV, indicating no confirmed mass exploitation, though the low attack complexity and available POC materially elevate near-term risk.

Technical ContextAI

DeepCool DisplayService (cpe:2.3:a:deepcool:displayservice:*:*:*:*:*:*:*:*) is a Windows service binary (C:\DeepCool\resources\service\x64\DeepCoolDisplayService.exe) that runs under the LocalSystem account to manage DeepCool hardware peripherals - typically ARGB controllers and display-capable cooling units. The service uses a Windows Named Pipe as its inter-process communication (IPC) channel. Named pipes are a standard Windows IPC mechanism, but when a SYSTEM-level service creates a pipe without a restrictive Security Descriptor (DACL), any local user process can open a handle to the pipe and send control messages. CWE-284 captures exactly this failure: access control is absent or misconfigured at the IPC boundary, which the 'Authentication Bypass' tag confirms - the pipe accepts and acts on commands with no caller identity verification. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L) corroborates this: local access with low complexity and no special attack requirements, consistent with a world-readable named pipe.

RemediationAI

No vendor-released patch has been identified at time of analysis - all available references point to the VulDB disclosure and researcher documentation rather than a DeepCool security advisory. Users should monitor the DeepCool support channels and VulDB entry (https://vuldb.com/vuln/386710) for patch availability. As a compensating control, restrict access to the named pipe object by modifying its Security Descriptor using Windows built-in tools (icacls or Set-Acl in PowerShell) to allow connections only from the SYSTEM account and members of the local Administrators group - this directly neutralizes the unauthenticated access condition. As an additional control, the DeepCoolDisplayService Windows service can be stopped and its start type set to Disabled on systems where the display management functionality is not required, with the trade-off of losing hardware display/ARGB control. On multi-user systems, enforcing a least-privilege user policy and auditing named pipe access via Sysmon EventID 17/18 can provide detection coverage until a vendor patch is released.