CVE-2026-41527

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-41527", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-04-22T15:35:24.571Z", "dateReserved": "2026-04-20T00:00:00.000Z", "datePublished": "2026-04-21T00:00:00.000Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "Kleopatra", "vendor": "KDE", "versions": [{"lessThan": "26.08.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "KDE Kleopatra before 26.08.0 on Windows allows local users to obtain the privileges of a Kleopatra user, because there is an error in the mechanism (KUniqueService) for ensuring that only one instance is running."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-670", "description": "CWE-670 Always-Incorrect Control Flow Implementation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-21T21:19:44.293Z"}, "references": [{"url": "https://github.com/KDE/kleopatra/releases"}, {"url": "https://commits.kde.org/kleopatra/73471abb92d99c56354adb582bfaec2764c22b79"}, {"url": "https://kde.org/info/security/advisory-20260408-1.txt"}], "x_generator": {"engine": "enrichogram 0.0.1"}, "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-22T12:58:38.651028Z", "id": "CVE-2026-41527", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T15:35:24.571Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41527", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-22T12:58:38.651028Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T12:58:50.724Z"}}], "cna": {"metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"}}], "affected": [{"vendor": "KDE", "product": "Kleopatra", "versions": [{"status": "affected", "version": "0", "lessThan": "26.08.0", "versionType": "custom"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/KDE/kleopatra/releases"}, {"url": "https://commits.kde.org/kleopatra/73471abb92d99c56354adb582bfaec2764c22b79"}, {"url": "https://kde.org/info/security/advisory-20260408-1.txt"}], "x_generator": {"engine": "enrichogram 0.0.1"}, "descriptions": [{"lang": "en", "value": "KDE Kleopatra before 26.08.0 on Windows allows local users to obtain the privileges of a Kleopatra user, because there is an error in the mechanism (KUniqueService) for ensuring that only one instance is running."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-670", "description": "CWE-670 Always-Incorrect Control Flow Implementation"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-21T21:19:44.293Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41527", "state": "PUBLISHED", "dateUpdated": "2026-04-22T15:35:24.571Z", "dateReserved": "2026-04-20T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-04-21T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "Kleopatra", "vendor": "KDE", "versions": [{"lessThan": "26.08.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "KDE Kleopatra before 26.08.0 on Windows allows local users to obtain the privileges of a Kleopatra user, because there is an error in the mechanism (KUniqueService) for ensuring that only one instance is running."}, {"lang": "es", "value": "KDE Kleopatra anterior a la versi\u00f3n 26.08.0 en Windows permite a usuarios locales obtener los privilegios de un usuario de Kleopatra, debido a un error en el mecanismo (KUniqueService) para asegurar que solo se ejecute una instancia."}], "id": "CVE-2026-41527", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 1.4, "impactScore": 5.5, "source": "cve@mitre.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41527", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-22T12:58:38.651028Z", "version": "2.0.3"}}]}, "published": "2026-04-21T22:16:20.363", "references": [{"source": "cve@mitre.org", "url": "https://commits.kde.org/kleopatra/73471abb92d99c56354adb582bfaec2764c22b79"}, {"source": "cve@mitre.org", "url": "https://github.com/KDE/kleopatra/releases"}, {"source": "cve@mitre.org", "url": "https://kde.org/info/security/advisory-20260408-1.txt"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-670"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["windows"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,26.08.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Kleopatra", "source": "cna", "vendor": "KDE"}, "product": "kleopatra", "vendor": "kde"}], "analysis": {"en": {"generated_at": "2026-04-22T06:57:55.878057+00:00", "value": {"mitigation_remediation": ["Upgrade Kleopatra to version 26.08.0 or later from the official KDE releases.", "If an immediate upgrade is not possible, uninstall the current Kleopatra installation and reinstall a fixed version from a trusted source.", "Reduce local account privileges to limit the impact of a potential privilege escalation within Kleopatra."], "summary": {"action": "Patch", "impact": "Local Privilege Escalation"}, "threat_synthesis": {"affected_systems": "The affected vendor is KDE, product Kleopatra. All releases prior to version 26.08.0 on Windows are impacted. No Windows\u2011specific sub\u2011versions or alternate operating systems were listed in the advisory.", "description_and_impact": "KDE Kleopatra before 26.08.0 on Windows contains a flaw in the KUniqueService component that does not correctly enforce the intended single\u2011instance rule. This error allows a local user to gain the privileges of the Kleopatra user, effectively escalating their privileges within the local environment. The vulnerability is aligned with CWE\u2011670 and provides attackers with the ability to perform actions as the Kleopatra user, potentially expanding the attack surface for local privileges.", "risk_and_exploitability": "The CVSS score of 6.9 indicates a medium severity risk, and the EPSS score is not available, making the precise exploitation probability unclear. The vulnerability is not listed in CISA's KEV catalog. Attackers need local user access on a Windows system; no remote or network\u2011based attack vector is described. The risk manifests as local privilege escalation, allowing a malicious local user to execute Kleopatra processes with elevated rights."}}}}, "created": "2026-04-22T07:00:12.128272+00:00", "title": "Local Privilege Escalation via KUniqueService in KDE Kleopatra", "updated": "2026-04-22T11:47:01.559036+00:00", "vendors": ["kde", "kde$PRODUCT$kleopatra"]}