CVEvulnerability

CVE-2026-110746

7.8 HIGH Published 2026-10-15 Modified 2026-10-16 Official page ↗

Status: Awaiting Analysis
Published: 2026-10-15
Last modified: 2026-10-16
Assigner: [email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-22, CWE-23

Description

A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the gRPC IPC authentication token, through loading IPC.dll and abuse the SYSTEM service's within TotalAV to execute arbitrary code as NT AUTHORITY\SYSTEM.

Weakness · CWE (2)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
CWE-23 Relative Path Traversal weakness

References

https://github.com/lukehebe/Vulnerability-Disclosures/tree/main/TotalAV-7.1.17-LPE github.com
https://www.totalav.com/ www.totalav.com
https://github.com/lukehebe/Vulnerability-Disclosures/blob/main/TotalAV-7.1.17-LPE/TotalAV_LPE.c github.com

CVE-2026-110746

Description

Related

Weakness · CWE (2)

References