CVE-2026-7006highCWE-494

CVE-2026-7006: fallo de gravedad alta en Sublime Text 4

Sublime Text 4192/3207 Local Privilege Escalation via Update Staging Mechanism

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Sublime Text

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

41Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 7epss 0.1%
Sublime Text for Windows through Build 4192 (Sublime Text 4) and Build 3207 (Sublime Text 3) contains a local privilege escalation vulnerability that allows unprivileged local attackers to execute arbitrary code with elevated privileges by abusing the update staging mechanism. Attackers can place a malicious DLL in the user-writable staging directory under %LOCALAPPDATA%, mark it read-only to bypass cleanup, and have the elevated installer copy it into the protected installation directory, causing the DLL to execute in the context of any higher-privileged user who subsequently launches the application.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
Sublime HQ Pty Ltd · Sublime Text 3Sublime HQ Pty Ltd · Sublime Text 4
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.