SiYuan EUVD-2026-68235

Exploitation requires three concurrent conditions: (1) the attacker has local low-privilege access to the target Windows system; (2) the attacker can write a file named after a system utility (e.g., TASKKILL.exe) into a directory on disk; and (3) an administrator runs the SiYuan NSIS installer from that same directory selecting all-users (elevated) installation mode. UAC elevation is granted at installer launch before the preInit hook executes, meaning the planted binary receives the elevated token without any additional UAC prompt. The vulnerability is limited to the installation-time window - it does not affect the installed SiYuan application at runtime. Key limiting factors: the attack requires local presence (physical or remote shell), the attacker must control or predict the directory from which the admin will run the installer, and exploitation only occurs during the installation event itself. Network-only attackers cannot exploit this directly.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:P, score 7.0) accurately reflects the attack profile: local access, low privilege, no special attack conditions, but requiring an administrator to run the installer. No CISA KEV listing and no public POC exist at time of analysis, keeping operational urgency moderate. The impact metrics are full (VC:H/VI:H/VA:H) because execution with an elevated token grants complete control over the vulnerable system. Real-world risk is meaningful in shared workstation environments, developer machines, or any scenario where untrusted users can write to directories from which privileged users run software. Enterprises where SiYuan is deployed via shared network paths or where installers are downloaded to shared locations face higher exposure. For organizations where local users are fully isolated, risk is low. EPSS score was not provided in the input data and cannot be assessed.

A low-privileged local attacker writes a malicious executable named TASKKILL.exe into a directory they share write access to with an administrator - such as a shared downloads folder, a network share, or a writable temp location - then waits for or socially engineers an administrator to download and run the SiYuan installer from that same directory with the all-users option selected. The NSIS preInit hook fires immediately upon launch with the elevated UAC token, resolves TASKKILL to the planted binary ahead of System32, and executes it with administrator-level privileges before the user sees any install UI. No public exploit code has been identified at time of analysis, but the technique is a well-understood variant of Windows binary planting.