CVE-2026-0776

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0776", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "state": "PUBLISHED", "assignerShortName": "zdi", "dateReserved": "2026-01-08T22:50:50.092Z", "datePublished": "2026-01-23T03:29:18.996Z", "dateUpdated": "2026-02-26T14:44:25.231Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2026-01-23T03:29:18.996Z"}, "title": "Discord Client Uncontrolled Search Path Element Local Privilege Escalation Vulnerability", "descriptions": [{"lang": "en", "value": "Discord Client Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Discord Client. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the discord_rpc module. The product loads a file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-27057."}], "affected": [{"vendor": "Discord", "product": "Client", "versions": [{"version": "1.0.9196", "status": "affected"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-427", "description": "CWE-427: Uncontrolled Search Path Element", "type": "CWE"}]}], "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-040/", "name": "ZDI-26-040", "tags": ["x_research-advisory"]}], "dateAssigned": "2026-01-08T22:50:50.127Z", "datePublic": "2026-01-09T16:50:36.139Z", "source": {"lang": "en", "value": "T. Do\u011fa Geli\u015fli"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.3, "baseSeverity": "HIGH"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0776", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-24T04:55:27.401832Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T14:44:25.231Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0776", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-24T04:55:27.401832Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-23T19:15:49.089Z"}}], "cna": {"title": "Discord Client Uncontrolled Search Path Element Local Privilege Escalation Vulnerability", "source": {"lang": "en", "value": "T. Do\u011fa Geli\u015fli"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "Discord", "product": "Client", "versions": [{"status": "affected", "version": "1.0.9196"}], "defaultStatus": "unknown"}], "datePublic": "2026-01-09T16:50:36.139Z", "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-040/", "name": "ZDI-26-040", "tags": ["x_research-advisory"]}], "dateAssigned": "2026-01-08T22:50:50.127Z", "descriptions": [{"lang": "en", "value": "Discord Client Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Discord Client. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the discord_rpc module. The product loads a file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-27057."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-427", "description": "CWE-427: Uncontrolled Search Path Element"}]}], "providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2026-01-23T03:29:18.996Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0776", "state": "PUBLISHED", "dateUpdated": "2026-02-26T14:44:25.231Z", "dateReserved": "2026-01-08T22:50:50.092Z", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "datePublished": "2026-01-23T03:29:18.996Z", "assignerShortName": "zdi"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Client", "vendor": "Discord", "versions": [{"status": "affected", "version": "1.0.9196"}]}], "source": "zdi-disclosures@trendmicro.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Discord Client Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Discord Client. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the discord_rpc module. The product loads a file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-27057."}, {"lang": "es", "value": "Vulnerabilidad de escalada de privilegios local por elemento de ruta de b\u00fasqueda no controlado en el Cliente de Discord. Esta vulnerabilidad permite a atacantes locales escalar privilegios en instalaciones afectadas del Cliente de Discord. Un atacante debe primero obtener la capacidad de ejecutar c\u00f3digo con privilegios bajos en el sistema objetivo para explotar esta vulnerabilidad.\n\nLa falla espec\u00edfica existe dentro del m\u00f3dulo discord_rpc. El producto carga un archivo desde una ubicaci\u00f3n no segura. Un atacante puede aprovechar esta vulnerabilidad para escalar privilegios y ejecutar c\u00f3digo arbitrario en el contexto de un usuario objetivo. Fue ZDI-CAN-27057."}], "id": "CVE-2026-0776", "lastModified": "2026-06-17T10:11:21.757", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.3, "impactScore": 5.9, "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0776", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-24T04:55:27.401832Z", "version": "2.0.3"}}]}, "published": "2026-01-23T04:16:04.933", "references": [{"source": "zdi-disclosures@trendmicro.com", "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-040/"}], "sourceIdentifier": "zdi-disclosures@trendmicro.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-427"}], "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T03:14:32.283402+00:00", "value": {"mitigation_remediation": ["Apply the latest Discord Client update that removes the insecure search path from the discord_rpc module", "Reconfigure the system to prevent the application from using system environment variables that specify search paths, or remove any directories that the module might access without restriction", "Ensure that the directory containing the discord_rpc binaries and data files is owned by the system user and has minimal write permissions so that only the application can read the files without exposing them to local users"], "summary": {"action": "Immediate Patch", "impact": "Local Privilege Escalation"}, "threat_synthesis": {"affected_systems": "Affecting all installations of the Discord Client. No specific version range is provided, so the risk applies to every released build until patched. Users of any Discord desktop edition should be aware that the discord_rpc module is the attack vector.\n", "description_and_impact": "The flaw resides in the discord_rpc module of the Discord Client, where the application loads a file from an unsecured location. This uncontrolled search path element allows a locally present attacker who can already run code with low privileges to execute arbitrary code as the user of the application. The vulnerability directly increases the privileges of a local threat actor, potentially giving them full control over the target system.\n", "risk_and_exploitability": "The vulnerability carries a CVSS score of 7.3, indicating moderate\u2011to\u2011high severity, and an EPSS score of less than 1\u202f%, suggesting a low likelihood of widespread exploitation at the present. It is not listed in the CISA KEV catalog. Exploitation requires a local attacker with the ability to execute low\u2011privileged code; no remote trigger is necessary or described. Once the attacker achieves code execution, privilege escalation can be performed in the context of the victim user, bypassing standard access controls.\n"}}}}, "created": "2026-01-23T10:26:53.560336+00:00", "updated": "2026-04-18T03:15:35.437056+00:00", "vendors": ["discord", "discord$PRODUCT$discord"]}