CVE-2026-12410

Summary

This vulnerability allows a local, low-privileged attacker to escalate privileges to SYSTEM by creating a symlink/junction during the uninstallation of CCleaner prior to 7.10.1464, which CCleaner follows when deleting the application's data folder with elevated integrity.

Exploitability

Exploitation requires local access and the ability to manipulate the uninstallation process. The attacker must have write permissions to the directory where the symlink/junction is created.

Blast radius

If exploited, the attacker can gain full control over the system, leading to potential data theft, system compromise, and unauthorized access to sensitive information.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to CCleaner version 7.10.1464 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.