CVE-2026-12410 PUBLISHED

CCleaner local privilege escalation via link following on uninstall

Assigner: GEN
Reserved: 16.06.2026 Published: 05.08.2026 Updated: 05.08.2026

Link following vulnerability in the Uninstaller component in CCleaner prior to 7.10.1464 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM via a symlink/junction created during application uninstallation, which CCleaner follows when deleting the application's data folder with elevated integrity.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 7.8

Attack Vector	Local	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	Gen Digital
Product	CCleaner
Versions	Default: unaffected affected from 0 to 7.10.1464 (excl.)

Solutions

Upgrade to CCleaner 7.10.1464 or later on Windows. All builds at or above 7.10.1464 include the fix.

Credits

Anonymous working with TrendAI Zero Day Initiative reporter

References

https://www.gendigital.com/us/en/contact-us/security-advisories/

Problem Types

CWE-59: Improper Link Resolution Before File Access ('Link Following') CWE

Impacts

Successful exploitation allows a local, low-privileged attacker to delete arbitrary files/folders with SYSTEM integrity by replacing the uninstall target folder with a symlink/junction, ultimately achieving local privilege escalation.