Vulnerability Description
Sublime Text for Windows through Build 4192 (Sublime Text 4) and Build 3207 (Sublime Text 3) contains a local privilege escalation vulnerability that allows unprivileged local attackers to execute arbitrary code with elevated privileges by abusing the update staging mechanism. Attackers can place a malicious DLL in the user-writable staging directory under %LOCALAPPDATA%, mark it read-only to bypass cleanup, and have the elevated installer copy it into the protected installation directory, causing the DLL to execute in the context of any higher-privileged user who subsequently launches the application.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://gist.github.com/anthok/765b3ca0223fabee38f51d8f832e2175
- https://www.sublimetext.com/
- https://www.vulncheck.com/advisories/sublime-text-4192-3207-local-privilege-esca
FAQ
What is CVE-2026-7006?
CVE-2026-7006 is a vulnerability with a CVSS score of 7.3 (HIGH). Sublime Text for Windows through Build 4192 (Sublime Text 4) and Build 3207 (Sublime Text 3) contains a local privilege escalation vulnerability that allows unprivileged local attackers to execute arb...
How severe is CVE-2026-7006?
CVE-2026-7006 has been rated HIGH with a CVSS base score of 7.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-7006?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.