CVE-2026-75135: UpSignOn < 7.19.0 Sensitive Key Retention in Memory
UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover the master password and decrypt vault contents by reading a retained backup key from the process memory of UpSignOn.exe, even after the vault has been re-locked. Attackers can extract the backup key from process memory to decrypt the encrypted master password backup stored in v6-vault1.DATA.txt, then use the recovered master password to decrypt the main vault and export all password manager entries in cleartext.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to exploitation?
Windows users running UpSignOn versions before 7.19.0 are exposed if a local attacker has the privileges needed to read the memory of the UpSignOn.exe process. The impact includes recovery of the master password and export of vault entries in cleartext.
Does re-locking the vault remove the exposure?
No. The retained backup key can remain in UpSignOn.exe process memory even after the vault has been re-locked, allowing an attacker to decrypt the stored encrypted master-password backup.
What files and process artifacts should be investigated?
Investigate memory associated with UpSignOn.exe and the presence of v6-vault1.DATA.txt. The described attack extracts a backup key from process memory and uses it to decrypt the encrypted master-password backup in that file.
What version resolves the issue?
The issue affects versions before 7.19.0. Updating to version 7.19.0 or later addresses the affected version range described.