{"id":"CVE-2026-1995","aliases":["EUVD-2026-14949","GHSA-c236-24xj-j3g6"],"status":"published","title":"IDrive Cloud Backup Client for Windows contains a privilege escalation vulnerability","description":"In versions before 7.0.0.64, IDrive’s id_service.exe process runs with elevated privileges and regularly reads from several files under the C:\\ProgramData\\IDrive\\ directory. The UTF16-LE encoded contents of these files are used as arguments for starting a process, but they can be edited by any standard user logged into the system. An attacker can overwrite or edit the files to specify a path to an arbitrary executable, which will then be executed by the id_service.exe process with SYSTEM privileges.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00177,"percentile":0.07335,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2026-03-24T18:00:15Z","modified":"2026-07-21T20:17:00Z","products":[{"vendor":"idrive","product":"idrive cloud backup client for windows"}],"references":[{"url":"https://kb.cert.org/vuls/id/330121"},{"url":"https://www.kb.cert.org/vuls/id/330121"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1995"},{"url":"https://github.com/advisories/GHSA-c236-24xj-j3g6"}],"sources":{"cve":[{"id":"CVE-2026-1995","title":"IDrive Cloud Backup Client for Windows contains a privilege escalation vulnerability","description":"In versions before 7.0.0.64, IDrive’s id_service.exe process runs with elevated privileges and regularly reads from several files under the C:\\ProgramData\\IDrive\\ directory. The UTF16-LE encoded contents of these files are used as arguments for starting a process, but they can be edited by any standard user logged into the system. An attacker can overwrite or edit the files to specify a path to an arbitrary executable, which will then be executed by the id_service.exe process with SYSTEM privileges.","status":"published","published":"2026-03-24T18:00:15.664Z","modified":"2026-07-21T19:18:15.556Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:20:01.271368Z"}],"euvd":[{"id":"EUVD-2026-14949","description":"In versions before 7.0.0.64, IDrive’s id_service.exe process runs with elevated privileges and regularly reads from several files under the C:\\ProgramData\\IDrive\\ directory. The UTF16-LE encoded contents of these files are used as arguments for starting a process, but they can be edited by any standard user logged into the system. An attacker can overwrite or edit the files to specify a path to an arbitrary executable, which will then be executed by the id_service.exe process with SYSTEM privileges.","status":"published","published":"2026-03-24T18:00:15Z","modified":"2026-07-21T19:18:15Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:19:46.900828Z"}],"ghsa":[{"id":"GHSA-c236-24xj-j3g6","title":"IDrive’s id_service.exe process runs with elevated privileges and regularly reads from several...","description":"IDrive’s id_service.exe process runs with elevated privileges and regularly reads from several files under the C:\\ProgramData\\IDrive\\ directory. The UTF16-LE encoded contents of these files are used as arguments for starting a process, but they can be edited by any standard user logged into the system. An attacker can overwrite or edit the files to specify a path to an arbitrary executable, which will then be executed by the id_service.exe process with SYSTEM privileges.","status":"published","published":"2026-03-24T21:31:23Z","modified":"2026-03-25T15:32:30Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:06:50.631069Z"}],"nvd":[{"id":"CVE-2026-1995","description":"In versions before 7.0.0.64, IDrive’s id_service.exe process runs with elevated privileges and regularly reads from several files under the C:\\ProgramData\\IDrive\\ directory. The UTF16-LE encoded contents of these files are used as arguments for starting a process, but they can be edited by any standard user logged into the system. An attacker can overwrite or edit the files to specify a path to an arbitrary executable, which will then be executed by the id_service.exe process with SYSTEM privileges.","status":"published","published":"2026-03-24T19:16:49.033Z","modified":"2026-07-21T20:17:00.307Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"updated_at":"2026-11-02T14:12:10.568062Z"}]}}