CVE-2026-49176 Windows WalletService Elevation of Privilege Flaw Gets Public PoC Exploit

TL;DR

CVE-2026-49176 is an elevation of privilege flaw in Windows WalletService. It lets a standard user gain SYSTEM rights on a Windows machine. Researcher David Carliez published full technical details and a public proof-of-concept exploit. Microsoft rates it Important, with a CVSS score of 7.8.

Why it matters

Local privilege escalation turns a small foothold into full control. So attackers prize bugs like this one. A SYSTEM token unlocks credential theft, security-tool tampering, and persistence. Shared workstations and RDP hosts raise the stakes further. With a public PoC now out, the barrier to abuse drops fast. Per Microsoft’s advisory, an authorized local user can elevate privileges.

How the attack works

Windows WalletService runs as LocalSystem. During setup, it opens a wallet database from the user’s Documents folder. A standard user can redirect that folder and plant a crafted database. The research write-up shows how a standard user triggers this path. The database uses the Extensible Storage Engine, which supports persisted callbacks. When the service opens the file as SYSTEM, a callback loads the attacker’s DLL. Microsoft maps the root cause to CWE-269 and CWE-59. Defenders can spot the chain at several points. For example, WalletService rarely loads a DLL from a user profile. This report shares no exploit code.

Affected versions

The flaw affects a wide range of supported Windows client and server builds. Notably, only local access is needed to start the chain. No internet exposure is required. Microsoft rates the issue Important rather than Critical, given the local requirement. Even so, EoP bugs remain a favorite for post-access attackers.

Patch and detection

First, install the July 14, 2026 cumulative update now. Microsoft ships the fix with no separate workaround. Also, watch for odd DLL loads by the WalletService svchost process. Carliez’s public proof-of-concept includes detection tips. Finally, inventory Wallet databases that predate a service’s first run. Officials report no in-the-wild exploitation yet. Still, this Windows WalletService flaw deserves quick action now that details are public.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.