CVE-2026-49176 — Windows WalletService Elevation of Privilege Vulnerability
Executive Summary
Improper privilege management in Windows WalletService allows an authorized attacker to elevate privileges locally.
Overview
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
EPSS Score
Affected Products
| Product | KB Article | Severity | Impact | Restart Required |
|---|---|---|---|---|
| Windows 10 Version 1607 for 32-bit Systems | 5099535 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 10 Version 1607 for x64-based Systems | 5099535 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 10 Version 1809 for 32-bit Systems | 5099538 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 10 Version 1809 for x64-based Systems | 5099538 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 10 Version 21H2 for 32-bit Systems | 5099539 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 10 Version 21H2 for ARM64-based Systems | 5099539 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 10 Version 21H2 for x64-based Systems | 5099539 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 10 Version 22H2 for 32-bit Systems | 5099539 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 10 Version 22H2 for ARM64-based Systems | 5099539 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 10 Version 22H2 for x64-based Systems | 5099539 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 Version 24H2 for ARM64-based Systems | 5101650 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 Version 24H2 for x64-based Systems | 5101650 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 Version 25H2 for ARM64-based Systems | 5101650 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 Version 25H2 for x64-based Systems | 5101650 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 Version 26H1 for ARM64-based Systems | 5101649 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 version 26H1 for x64-based Systems | 5095051 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows Server 2016 | 5099535 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows Server 2016 (Server Core installation) | 5099535 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows Server 2019 | 5099538 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows Server 2019 (Server Core installation) | 5099538 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows Server 2022 | 5099540 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows Server 2025 | 5099536 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows Server 2025 (Server Core installation) | 5099536 (Security Update) |
Important | Elevation of Privilege | Yes |
Patches
| Article | Type | Restart |
|---|---|---|
5099535 |
Security Update | Yes |
5099538 |
Security Update | Yes |
5099539 |
Security Update | Yes |
5101650 |
Security Update | Yes |
5101649 |
Security Update | Yes |
5095051 |
Security Update | Yes |
5099540 |
Security Update | Yes |
5099536 |
Security Update | Yes |
Patch Diff
Improper privilege management (CWE-269) with link following (CWE-59) in the Windows WalletService walletservice.dll wallet-folder setup, local EoP to SYSTEM. WalletService runs as SYSTEM and provisions a per-user wallet database folder. PRE: after creating/opening the wallet folder (Wallet::WalletDatabaseESE::Open), the service post-hoc secured it by path via Wallet::ServerUtils::HideAndRestrictFolder -> GetFileAttributesW/SetFileAttributesW(FILE_ATTRIBUTE_HIDDEN) and IsFolderRestricted/RestrictFolder(param_1) (build an ACL and apply it to the folder path). Because these operations act on the folder by name after creation, a local user could plant a symbolic link / junction at the wallet path so the SYSTEM service follows the link and applies attributes/ACLs to (or otherwise operates on) an attacker-chosen target, and the non-atomic create-then-restrict left a window of improper privilege management (CWE-59 + CWE-269). Diff of walletservice.dll 10.0.26100.8737 -> .8875 (Jul 14 2026, KB5101650) confirms the fix: gated behind CFR flag Feature_3305877819, HideAndRestrictFolder no longer performs the post-creation by-path hide/IsFolderRestricted/RestrictFolder sequence (that whole block is skipped when the flag is enabled); the wallet folder is instead established with the correct restrictions through the reworked WalletDatabaseESE::Open / corruption-handling path, removing the follow-the-link window. FileUtils::DeleteFiles and WalletDatabaseESE::HandleDatabaseCorruption were updated alongside. Note: the fix is confirmed as the Feature_3305877819-gated removal of the racy by-path restrict; the exact secure-creation replacement spans the Open/corruption path.
| Function | Address | Change | Note |
|---|---|---|---|
Wallet::ServerUtils::HideAndRestrictFolder |
code change |
code (post-creation by-path hide/restrict removed, CFR-gated) | Pre: GetFileAttributesW/SetFileAttributesW(+FILE_ATTRIBUTE_HIDDEN) then IsFolderRestricted/RestrictFolder(param_1) on the folder path after creation -> follows a planted symlink/junction; race between create and restrict. Post (Feature_3305877819 enabled): the entire by-path hide/restrict block is skipped; folder security is established at creation instead. |
Wallet::WalletDatabaseESE::Open |
code change |
code (folder now established restricted at creation) | Reworked open/creation path so the wallet folder is created with correct restrictions rather than restricted post-hoc by path. |
Wallet::FileUtils::DeleteFiles |
code change |
code (file-deletion path updated) | Deletion helper used by corruption handling updated alongside the folder-setup change. |
Wallet::WalletDatabaseESE::HandleDatabaseCorruption |
code change |
code (corruption path updated) | DB corruption handling (which deletes/recreates the store) updated in concert with the secure folder setup. |
Feature_3305877819 |
gate |
added (CFR gate) | CFR flag gating removal of the racy by-path restrict in favor of restricted-at-creation; the original link-following-prone path still ships when disabled. |
Attack Path
WalletService secures its folder by path after creation, so a planted link redirects the SYSTEM attribute/ACL operations
Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.
Exploits & PoC
2 public PoCsUnverified third-party code
Public proof-of-concept repositories aggregated from PoC-in-GitHub. They are not reviewed and may be incomplete, non-functional, or malicious — inspect the code before running anything.
| Repository | Stars | Published | Description |
|---|---|---|---|
| DavidCarliez/CVE-2026-49176_LPE_POC | 51 | 2026-07-16 | Local privilege-escalation proof of concept for the Windows WalletService vulnerability fixed in July 2026. |
| 777erp/CVE-2026-49176_BOF | 5 | 2026-07-29 | CVE-2026-49176 WalletService LPE — standalone PoC + Cobalt Strike BOF (SYSTEM command on interactive session) |