Local Privilege Escalation in ANSSI DFIR-ORC by Loading DLLs

CVE-2026-11958

What is CVE-2026-11958?

A local privilege escalation vulnerability exists in ANSSI's DFIR-ORC, versions 10.2.7 and earlier. This flaw allows an attacker who has prior access to the system to exploit a shared temporary directory to load a malicious DLL from C:\Windows\Temp. As DFIR-ORC is executed with administrative privileges from this directory, the attacker can gain elevated permissions, potentially compromising the security of the affected machine. Immediate action is advised to mitigate this risk.

References