CVE-2026-96188: Microsoft PowerToys Elevation of Privilege Vulnerability
External control of system or configuration setting in Microsoft PowerToys allows an authorized attacker to elevate privileges locally.
Other sources
Microsoft PowerToys Elevation of Privilege Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.101.2632.0
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must already be authorized on the affected system and must be able to act locally. The attack is not described as remotely exploitable.
Does exploitation require user interaction?
Yes. The supplied CVSS vector indicates that user interaction is required, although the specific interaction is not described.
What is the potential impact if exploitation succeeds?
A successful attacker could elevate privileges locally. The provided severity vector indicates high impact to confidentiality, integrity, and availability.