Dell Inventory Collector EUVD-2026-84100

Exploitation requires local, authenticated access to a Windows host running Dell Inventory Collector Client prior to version 15.0.0, plus write permission to a directory that falls earlier in an unquoted service or binary search path (the standard CWE-428 precondition). The attacker must be able to have the vulnerable service/component started (or wait for a reboot/restart) so the unquoted path is re-resolved to the planted binary. Limiting factors: it is not network-reachable (AV:L), needs an existing low-privileged foothold (PR:L), and no user interaction (UI:N); it applies only to unpatched versions below 15.0.0 on affected Dell client installations.

The vendor CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8 High) is internally consistent with the description: a low-privileged LOCAL attacker (PR:L, AV:L) exploits an unquoted search path (CWE-428) to gain code execution and privilege escalation with high impact to confidentiality, integrity, and availability - the classic SYSTEM-level EoP profile for a Windows service running under an unquoted path. Real-world risk is genuine but bounded: exploitation requires an attacker to already have a local, authenticated foothold on the host (PR:L), so this is a privilege-escalation/persistence primitive rather than an initial-access vulnerability. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or automated mass targeting - this should be prioritized as a patch-management/EoP hardening item, not an emergency remote threat. Note a labeling conflict: the input Tags include 'RCE', but the CVSS vector is explicitly AV:L (local), so this is local code execution / privilege escalation, NOT remote code execution - do not treat it as network-reachable. Also note the referenced advisory (DSA-2026-381) is titled for SupportAssist/Optimizer/Trusted Device/Command Update rather than naming Inventory Collector Client directly; the product-to-CVE mapping rests on the CPE string and should be confirmed against Dell's advisory matrix.

An attacker with an existing low-privileged local account on a Windows PC running Dell Inventory Collector Client (pre-15.0.0) plants a malicious executable at a writable directory earlier in an unquoted service/binary search path. When the affected service or component starts under a higher-privilege context, Windows resolves the unquoted path to the attacker's binary and runs it, yielding SYSTEM-level code execution and privilege escalation. No public exploit code was identified at time of analysis, though unquoted-search-path exploitation is a well-understood, low-complexity technique.