CVE-2026-1995
Privilege Escalation via Insecure File Handling in IDrive Service
Publication date: 2026-03-24
Last updated on: 2026-03-25
Assigner: CERT/CC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| idrive | idrive_cloud_backup_client | to 7.0.0.63 (exc) |
| idrive | idrive_cloud_backup_client | to 7.0.0.63 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability involves the IDrive software's id_service.exe process, which runs with elevated SYSTEM privileges. This process reads from several files located in the C:\ProgramData\IDrive\ directory. These files contain UTF16-LE encoded data that is used as arguments to start another process. However, these files can be modified by any standard user on the system.
Because standard users can edit these files, an attacker can overwrite them to specify a path to an arbitrary executable. When the id_service.exe process reads these manipulated files, it will execute the specified executable with SYSTEM-level privileges, potentially allowing the attacker to run malicious code with the highest level of access on the system.
How can this vulnerability impact me? :
This vulnerability can have severe impacts because it allows an attacker with standard user access to escalate their privileges to SYSTEM level by executing arbitrary code.
- An attacker could gain full control over the affected system.
- They could install malware, steal sensitive data, or disrupt system operations.
- It undermines the security model by allowing privilege escalation from a low-privileged user to SYSTEM.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know