CVE-2026-75137: UpSignOn < 7.19.0 Sensitive Data Exposure in Process Memory after Lock
UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover cleartext vault data from process memory even after the application has been locked. Attackers can use the PROCESSVMREAD permission to read the memory space of UpSignOn.exe and extract sensitive fields including entry names, URLs, usernames, passwords, TOTP secrets, and notes.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A local attacker who has PROCESS_VM_READ permission against the UpSignOn.exe process can exploit it. The attack requires local access and low privileges; no user interaction is required.
What information may be exposed?
An attacker can recover cleartext vault data from UpSignOn.exe memory after the application is locked. Exposed fields can include entry names, URLs, usernames, passwords, TOTP secrets, and notes.
Does locking the application prevent exposure?
No. On affected versions, cleartext vault data may remain recoverable from process memory even after UpSignOn has been locked.
Which versions are affected?
UpSignOn for Windows versions before 7.19.0 are affected. Version 7.19.0 is identified in the available release notes as the relevant fixed release.