CVE-2026-6645

An insecure process execution vulnerability exists in the pc-printer-updater.exe component of the PaperCut Print Deploy Client for Windows. The application, which typically operates with high-level system privileges, attempts to perform an internal validation check by invoking a secondary system utility using an unqualified file reference. Because the application does not specify an absolute path to this utility, it relies on the operating system's default search order to locate the executable. Under specific conditions, a local attacker with the ability to modify directories within the system's search path could plant a malicious binary that mimics the expected utility. This could result in the malicious code being executed with SYSTEM privileges, leading to a full compromise of the affected host.

CVSS

No CVSS.

References

Link	Resource
https://www.papercut.com/kb/Main/papercut-ng-mf-security-bulletin-june-2026/

Configurations

No configuration.

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de ejecución de proceso insegura existe en el componente pc-printer-updater.exe del cliente PaperCut Print Deploy para Windows. La aplicación, que normalmente opera con privilegios de sistema de alto nivel, intenta realizar una comprobación de validación interna invocando una utilidad de sistema secundaria utilizando una referencia de archivo no cualificada. Debido a que la aplicación no especifica una ruta absoluta a esta utilidad, se basa en el orden de búsqueda predeterminado del sistema operativo para localizar el ejecutable. Bajo condiciones específicas, un atacante local con la capacidad de modificar directorios dentro de la ruta de búsqueda del sistema podría plantar un binario malicioso que imita la utilidad esperada. Esto podría resultar en la ejecución del código malicioso con privilegios de SYSTEM, lo que llevaría a un compromiso total del host afectado.

Information

Published : 2026-06-22 04:17

Updated : 2026-10-25 23:10

NVD link : CVE-2026-6645

Mitre link : CVE-2026-6645

CVE.ORG link : CVE-2026-6645

JSON object : View

Products Affected

No product.

CWE

CWE-427

Uncontrolled Search Path Element

{"id": "CVE-2026-6645", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6645", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-22T00:00:00+00:00"}}], "cvssMetricV40": [{"type": "Secondary", "source": "eb41dac7-0af8-4f84-9f6d-0272772514f4", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.3, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "eb41dac7-0af8-4f84-9f6d-0272772514f4", "affectedData": [{"vendor": "PaperCut", "product": "Print Deploy", "versions": [{"status": "affected", "version": "0", "lessThan": "1.10.4178", "versionType": "semver"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}]}], "published": "2026-06-22T04:17:13.310", "references": [{"url": "https://www.papercut.com/kb/Main/papercut-ng-mf-security-bulletin-june-2026/", "source": "eb41dac7-0af8-4f84-9f6d-0272772514f4"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "eb41dac7-0af8-4f84-9f6d-0272772514f4", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "An insecure process execution vulnerability exists in the pc-printer-updater.exe component of the PaperCut Print Deploy Client for Windows. The application, which typically operates with high-level system privileges, attempts to perform an internal validation check by invoking a secondary system utility using an unqualified file reference.\n\n\n\nBecause the application does not specify an absolute path to this utility, it relies on the operating system's default search order to locate the executable. Under specific conditions, a local attacker with the ability to modify directories within the system's search path could plant a malicious binary that mimics the expected utility. This could result in the malicious code being executed with SYSTEM privileges, leading to a full compromise of the affected host."}, {"lang": "es", "value": "Una vulnerabilidad de ejecuci\u00f3n de proceso insegura existe en el componente pc-printer-updater.exe del cliente PaperCut Print Deploy para Windows. La aplicaci\u00f3n, que normalmente opera con privilegios de sistema de alto nivel, intenta realizar una comprobaci\u00f3n de validaci\u00f3n interna invocando una utilidad de sistema secundaria utilizando una referencia de archivo no cualificada.\n\nDebido a que la aplicaci\u00f3n no especifica una ruta absoluta a esta utilidad, se basa en el orden de b\u00fasqueda predeterminado del sistema operativo para localizar el ejecutable. Bajo condiciones espec\u00edficas, un atacante local con la capacidad de modificar directorios dentro de la ruta de b\u00fasqueda del sistema podr\u00eda plantar un binario malicioso que imita la utilidad esperada. Esto podr\u00eda resultar en la ejecuci\u00f3n del c\u00f3digo malicioso con privilegios de SYSTEM, lo que llevar\u00eda a un compromiso total del host afectado."}], "lastModified": "2026-10-25T23:10:00.167", "sourceIdentifier": "eb41dac7-0af8-4f84-9f6d-0272772514f4"}