VulnerabilityDeferred

CVE-2026-18606

A weakness has been identified in Razer RzUpdateService 1.10.14.0.

HIGH 7.1EPSS 0.11%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.11%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A weakness has been identified in Razer RzUpdateService 1.10.14.0. Affected by this vulnerability is an unknown functionality of the file C:\Program Files (x86)\Razer\RzUpdateEngineService\RzUpdateService.exe of the component Named Pipe Handler. Executing a manipulation of the argument lpThreadParameter can lead to improper privilege management. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.

CVSS 4.0: 7.1 HIGHCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.11% probability · 1th percentile
CISA KEV: Not listed
Weakness: CWE-266, CWE-269
Source: cna@vuldb.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.