CVE-2026-57239

HighCVSS 7.8/10Last modified Jul 9, 2026

Description

The user-controllable executable files will be directly executed by high-privilege processes, allowing low-privilege users to have the opportunity to elevate their privileges to NT AUTHORITY\SYSTEM.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

No affected versions have been published.

Timeline

Published
Jul 8, 2026
Last modified
Jul 9, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-57246.3The frontend gRPC server's streaming interceptor chain did not include the authorization interceptor. When a ClaimMapper and Authorizer are CVE-2026-572407.8When the application opens a PDF file and JavaScript deletes the PDF fields, the subsequent logic still uses the old field pointers, resultiCVE-2026-572416.1The application opens the PDF, and JavaScript performs operations on the page and the document, causing the page-related objects within the CVE-2026-572427.8The application opens the PDF, and JavaScript modifies the form. However, the related objects on the page lack complete lifecycle managementCVE-2026-572436.1During the process of page opening and form formatting, a JavaScript reentrancy results in an inconsistent document status. Subsequently, wiCVE-2026-572447.8After JavaScript resetting the form, the synchronization process lacks re-entry protection and object lifecycle verification, resulting in tCVE-2026-572457.8When the application opens a PDF, traverses and builds the annotation elements related to hyperlinks, it fails to validate the abnormal annoCVE-2026-572467.8When dealing with abnormally constructed objects, there is a lack of argument validation; JavaScript triggers signature verification, but thCVE-2026-572477.8The application re-enters the document structure via field processing and deletes the current page, and then continues using the field objecCVE-2026-572487.8When the application opens a PDF file and JavaScript writes annotation attributes, there is a lack of sufficient object type and argument chCVE-2026-572497.8After the application opened the PDF file, the script first reset the annotation status, then triggered the reset form event by additional aCVE-2026-57256.1The Favicon Rotator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'fvrt_' prefixed request parameters in all