CVE-2026-7006: Sublime Text 4192/3207 Local Privilege Escalation via Update Staging Mechanism
Sublime Text for Windows through Build 4192 (Sublime Text 4) and Build 3207 (Sublime Text 3) contains a local privilege escalation vulnerability that allows unprivileged local attackers to execute arbitrary code with elevated privileges by abusing the update staging mechanism. Attackers can place a malicious DLL in the user-writable staging directory under %LOCALAPPDATA%, mark it read-only to bypass cleanup, and have the elevated installer copy it into the protected installation directory, causing the DLL to execute in the context of any higher-privileged user who subsequently launches the application.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Sublime Text 4 for Windowsto a version that resolves this vulnerability.Fixed in 4192 - Upgrade
Upgrade
Sublime Text 3 for Windowsto a version that resolves this vulnerability.Fixed in 3207
Event History
Frequently Asked Questions
Who is realistically exposed to privilege escalation?
Windows systems running Sublime Text 4 through Build 4192 or Sublime Text 3 through Build 3207 are exposed when an unprivileged local user can prepare the staging directory and a higher-privileged user later launches the application.
What does an attacker need to exploit this issue?
The attacker needs unprivileged local access and the ability to place a malicious DLL in the user-writable staging directory under %LOCALAPPDATA%. They must mark the DLL read-only so it bypasses cleanup before the elevated installer copies it into the protected installation directory.
What event causes the malicious DLL to run with elevated privileges?
Execution occurs when a higher-privileged user subsequently launches Sublime Text after the malicious DLL has been copied into the installation directory. The DLL then runs in that higher-privileged user's context.
How can administrators identify systems that should be considered affected?
Identify Windows installations of Sublime Text 4 at Build 4192 or earlier, and Sublime Text 3 at Build 3207 or earlier. Systems are particularly relevant for triage if unprivileged users can log on locally and higher-privileged users launch the application on the same machine.