CVE-2026-18606
Razer RzUpdateService Named Pipe RzUpdateService.exe privileges management
CVSS Score
7.8
EPSS Score
0.0%
EPSS Percentile
0th
A weakness has been identified in Razer RzUpdateService 1.10.14.0. Affected by this vulnerability is an unknown functionality of the file C:\Program Files (x86)\Razer\RzUpdateEngineService\RzUpdateService.exe of the component Named Pipe Handler. Executing a manipulation of the argument lpThreadParameter can lead to improper privilege management. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.
| CWE | CWE-269 CWE-266 |
| Vendor | razer |
| Product | rzupdateservice |
| Published | Aug 3, 2026 |
| Last Updated | Aug 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for razer rzupdateservice
Be the first to know when new high vulnerabilities affecting razer rzupdateservice are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Razer / RzUpdateService
1.10.14.0
References
vuldb.com: https://vuldb.com/vuln/385529 vuldb.com: https://vuldb.com/vuln/385529/cti vuldb.com: https://vuldb.com/cve/CVE-2026-18606 vuldb.com: https://vuldb.com/submit/852045 opcodic.notion.site: https://opcodic.notion.site/Privilege-Escalation-via-Insecure-Named-Pipe-in-RzUpdateService-2d88e7fec518803fa5decf10fb0e1e27
Credits
🔍 opcodic (VulDB User) VulDB CNA Team