CVE-2026-11958— Local privilege escalation in ANSSI’s DFIR-ORC
Possible ATT&CK Techniques 2AI
T1055.001 · Dynamic-link Library Injection T1574.007 · Path Interception by PATH Environment VariableGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-11958
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Local privilege escalation in ANSSI’s DFIR-ORC
Source: NVD (National Vulnerability Database)
Vulnerability Description
Local privilege escalation by loading DLLs from a shared temporary directory in ANSSI’s DFIR-ORC, versions 10.2.7 and prior. An attacker with prior access to the system, can place a malicious DLL in C:\Windows\Temp and wait for the application to be executed. Because DFIR-ORC is extracted and executed from that location with administrative privileges, the malicious library can be loaded automatically, allowing the attacker to gain administrator privileges on the affected machine.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
对搜索路径元素未加控制
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-11958
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-11958
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-11958 (1)
Vendor Pages for CVE-2026-11958 (1)
IV. Related Vulnerabilities
Same weakness: CWE-427
- CVE-2026-54672
electron-updater: Uncontrolled search path elements within ` - CVE-2025-13162
Advant Master Online Builder DLL vulnerability - CVE-2026-54232
vLLM: Dependency Confusion Vulnerability in vLLM Dockerfile - CVE-2026-6645
Insecure Search Path Vulnerability in PaperCut Print Deploy - CVE-2026-12003
CPython >3.11 Insecure Input Validation resulting in privile
V. Comments for CVE-2026-11958
No comments yet