Improper Privilege Management in ESET AV Remover

Executive Summary

CVE-2026-12858 is a high-severity local privilege escalation vulnerability in ESET AV Remover. It occurs due to missing authentication in an RPC interface of the tool’s helper executable. An attacker with prior administrator rights could exploit this by sending a crafted RPC request to load a malicious DLL, executing code with SYSTEM privileges.

Useful 0 Not Useful 0

Detection Guidance

Check if ESET AV Remover is installed and running. Verify the version installed against the affected versions (1.6.11.0 or earlier). Use system tools to inspect running processes and RPC interfaces for suspicious activity.

Useful 0 Not Useful 0

Impact Analysis

If you have ESET AV Remover installed, an attacker with admin rights could exploit this to gain SYSTEM privileges on your system. This could allow them to take full control of your computer, install malware, or access sensitive data. The vulnerability only affects systems where the tool is actively running.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with standards like GDPR and HIPAA by enabling unauthorized privilege escalation. An attacker gaining SYSTEM privileges could access or modify sensitive data, violating confidentiality and integrity requirements under these regulations. The lack of authentication in the RPC interface increases the risk of such breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Update ESET AV Remover to version 1.6.17.0 or later. For ESET Endpoint Security and ESET Endpoint Antivirus, update to version 13.0.2058.0 or later. Remove or disable the affected tool if not needed.

Useful 0 Not Useful 0