Sublime Text 4
Monthly
Local privilege escalation in Sublime Text for Windows - Sublime Text 4 through Build 4192 and Sublime Text 3 through Build 3207 - lets an authenticated local attacker who already holds an unprivileged account plant a malicious DLL in the user-writable update staging directory under %LOCALAPPDATA%, mark it read-only to defeat the installer's cleanup pass, and have the elevated installer copy the payload into the protected installation directory, where it executes in the context of any higher-privileged user who later launches the editor. The attack is local-only and conditional: it requires a prior foothold on the host, depends on the update staging mechanism being reached, and fires only when an elevated user subsequently opens the application (passive user interaction). Risk is real but situational rather than a mass-exploitation threat, and publicly available exploit code exists in the form of a published gist, so EPSS-style prioritization should focus on multi-user Windows endpoints where a standard user and an administrator both use the same Sublime Text install. No vendor-released patch is identified in the available data at time of analysis.
Local privilege escalation in Sublime Text for Windows - Sublime Text 4 through Build 4192 and Sublime Text 3 through Build 3207 - lets an authenticated local attacker who already holds an unprivileged account plant a malicious DLL in the user-writable update staging directory under %LOCALAPPDATA%, mark it read-only to defeat the installer's cleanup pass, and have the elevated installer copy the payload into the protected installation directory, where it executes in the context of any higher-privileged user who later launches the editor. The attack is local-only and conditional: it requires a prior foothold on the host, depends on the update staging mechanism being reached, and fires only when an elevated user subsequently opens the application (passive user interaction). Risk is real but situational rather than a mass-exploitation threat, and publicly available exploit code exists in the form of a published gist, so EPSS-style prioritization should focus on multi-user Windows endpoints where a standard user and an administrator both use the same Sublime Text install. No vendor-released patch is identified in the available data at time of analysis.