CVE-2026-18606: Razer RzUpdateService Named Pipe RzUpdateService.exe privileges management
A weakness has been identified in Razer RzUpdateService 1.10.14.0. Affected by this vulnerability is an unknown functionality of the file C:\Program Files (x86)\Razer\RzUpdateEngineService\RzUpdateService.exe of the component Named Pipe Handler. Executing a manipulation of the argument lpThreadParameter can lead to improper privilege management. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18606?
The severity of CVE-2026-18606 is rated as high with a CVSS score of 7.8.
How do I fix CVE-2026-18606?
To mitigate CVE-2026-18606, update to the latest version of Razer RzUpdateService.
What components are affected by CVE-2026-18606?
CVE-2026-18606 affects the Razer RzUpdateService executable, specifically the Named Pipe Handler component.
What type of vulnerability is CVE-2026-18606?
CVE-2026-18606 is a privilege escalation vulnerability found in the Razer RzUpdateService.
What should users do if they are running Razer RzUpdateService version 1.10.14.0?
Users running Razer RzUpdateService version 1.10.14.0 should immediately apply the available updates to secure their systems.