{"id":"CVE-2026-11958","aliases":["EUVD-2026-37877"],"status":"published","title":"Local privilege escalation in ANSSI’s DFIR-ORC","description":"Local privilege escalation by loading DLLs from a shared temporary directory in ANSSI’s DFIR-ORC, versions 10.2.7 and prior. An attacker with prior access to the system, can place a malicious DLL in C:\\Windows\\Temp and wait for the application to be executed. Because DFIR-ORC is extracted and executed from that location with administrative privileges, the malicious library can be loaded automatically, allowing the attacker to gain administrator privileges on the affected machine.","severity":{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00102,"percentile":0.00912,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-427"],"published":"2026-06-18T11:01:16Z","modified":"2026-10-28T02:30:27Z","products":[{"vendor":"anssi","product":"dfir-orc"}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/local-privilege-escalation-anssis-dfir-orc","tags":["patch","fix"]},{"url":"https://github.com/DFIR-ORC/dfir-orc/releases/tag/v10.3.0","tags":["vendor-advisory","patch","fix"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11958.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11958","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-11958","title":"Local privilege escalation in ANSSI’s DFIR-ORC","description":"Local privilege escalation by loading DLLs from a shared temporary directory in ANSSI’s DFIR-ORC, versions 10.2.7 and prior. An attacker with prior access to the system, can place a malicious DLL in C:\\Windows\\Temp and wait for the application to be executed. Because DFIR-ORC is extracted and executed from that location with administrative privileges, the malicious library can be loaded automatically, allowing the attacker to gain administrator privileges on the affected machine.","status":"published","published":"2026-06-18T11:01:16.727Z","modified":"2026-06-18T12:28:09.762Z","cvss":[{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high","assessor":"cna"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T14:20:04.809935Z"}],"euvd":[{"id":"EUVD-2026-37877","description":"Local privilege escalation by loading DLLs from a shared temporary directory in ANSSI’s DFIR-ORC, versions 10.2.7 and prior. An attacker with prior access to the system, can place a malicious DLL in C:\\Windows\\Temp and wait for the application to be executed. Because DFIR-ORC is extracted and executed from that location with administrative privileges, the malicious library can be loaded automatically, allowing the attacker to gain administrator privileges on the affected machine.","status":"published","published":"2026-06-18T11:01:16Z","modified":"2026-06-18T12:28:09Z","cvss":[{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high"}],"updated_at":"2026-11-02T18:20:36.672794Z"}],"nvd":[{"id":"CVE-2026-11958","description":"Local privilege escalation by loading DLLs from a shared temporary directory in ANSSI’s DFIR-ORC, versions 10.2.7 and prior. An attacker with prior access to the system, can place a malicious DLL in C:\\Windows\\Temp and wait for the application to be executed. Because DFIR-ORC is extracted and executed from that location with administrative privileges, the malicious library can be loaded automatically, allowing the attacker to gain administrator privileges on the affected machine.","status":"published","published":"2026-06-18T14:17:20.617Z","modified":"2026-10-26T11:10:00.157Z","cvss":[{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T14:12:24.912854Z"}],"osv":[{"id":"CVE-2026-11958","title":"Local privilege escalation in ANSSI’s DFIR-ORC","description":"Local privilege escalation by loading DLLs from a shared temporary directory in ANSSI’s DFIR-ORC, versions 10.2.7 and prior. An attacker with prior access to the system, can place a malicious DLL in C:\\Windows\\Temp and wait for the application to be executed. Because DFIR-ORC is extracted and executed from that location with administrative privileges, the malicious library can be loaded automatically, allowing the attacker to gain administrator privileges on the affected machine.","status":"published","published":"2026-06-18T11:01:16.727Z","modified":"2026-10-28T02:30:27.281871011Z","cvss":[{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T15:44:57.354194Z"}]}}