High
Security advisory
Improper privilege management in Windows Package Manager allows an authorized attacker to elevate privileges locally.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-68821
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 10:36 UTC · Revision 1
Source evidence
Improper privilege management in Windows Package Manager allows an authorized attacker to elevate privileges locally.
osv:CVE-2026-68821
Complete source record
{
"id": "204b712a589c4c4bf626a53b785d2c955f7066712737a3a034ddc5c19e4245b7",
"url": "https://osv.dev/vulnerability/CVE-2026-68821",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2026-68821",
"summary": "Improper privilege management in Windows Package Manager allows an authorized attacker to elevate privileges locally.",
"evidence": "osv:CVE-2026-68821",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-68821",
"aliases": [
"CVE-2026-68821"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/microsoft/winget-cli",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "fe424a114b6c0aa465450e3b622905e33cf3ed6d"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:microsoft:app_installer:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "1.29.280"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v1.29.250",
"v1.29.20-preview",
"v1.29.240",
"v1.29.170-preview",
"v1.29.160-preview",
"v1.29.140-preview",
"v1.29.70-preview",
"v1.29.50-preview",
"v1.29.30-preview",
"v1.28.110-preview",
"v1.28.100-preview",
"v1.28.90-preview",
"v1.12.250-preview",
"v1.12.240-preview",
"v1.12.210-preview",
"v1.12.170-preview",
"v1.12.100-preview",
"v1.11.400",
"v1.11.370-preview",
"v1.11.350-preview",
"v1.11.320-preview",
"v1.11.230-preview",
"v1.11.220-preview",
"v1.11.210-preview",
"v1.11.200-preview",
"v1.11.190-preview",
"v1.11.180-preview",
"v1.10.40-preview",
"v1.10.30-preview",
"v1.9.2507",
"v1.9.2411-preview",
"v1.9.2151-preview",
"v1.9.1981-preview",
"v1.9.1792-preview",
"v1.9.1763-preview",
"v1.8.1522",
"v1.9.1551-preview",
"v1.8.1133-preview",
"v1.8.924-preview",
"v1.7.10514",
"v1.8.532-preview",
"v1.7.3481-preview",
"v1.7.3452-preview",
"v1.7.3172-preview",
"v1.7.2782-preview",
"v1.7.2722-preview",
"v1.7.2711-preview",
"v1.6.2631",
"v1.6.2482",
"v1.7.2491-preview",
"v1.6.2291-preview",
"v1.5.1572",
"v1.6.1573-preview",
"v1.5.1361-preview",
"v1.5.1081-preview",
"v1.5.441-preview",
"v1.4.10052",
"v1.5.101-preview",
"v1.4.3531",
"v1.4.3132-preview",
"v1.4.2161-preview",
"v1.4.2011-preview",
"v1.3.1661-preview",
"v1.3.1611",
"v.1.3.1661-preview",
"v.1.3.1611",
"v1.3.1391-preview",
"v1.3.1251-preview",
"v1.3.431",
"v1.2.3411-preview",
"v1.0.12576",
"v1.0.11692",
"v1.0.11451",
"v-0.4.11391-preview",
"v-0.3.11201-preview",
"v-0.3.11102-preview",
"v-0.2.10971-preview",
"v-0.2.10771-preview",
"v-0.2.10191-preview",
"v0.2.3162-preview",
"v0.2.2941-preview",
"v0.1.42241-preview",
"v0.1.41821-preview",
"v0.1.4331-preview"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68821.json",
"vanir_signatures": [
{
"id": "CVE-2026-68821-4eeda43b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"111663460331716961421611083460455081241",
"274888525669408001879448420251146448563",
"287421967737626575517269826003325284191"
]
},
"source": "https://github.com/microsoft/winget-cli/commit/fe424a114b6c0aa465450e3b622905e33cf3ed6d",
"target": {
"file": "src/AppInstallerSharedLib/AppInstallerStrings.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-68821-690c1da0",
"digest": {
"threshold": 0.9,
"line_hashes": [
"132494067554770812465553683740565671131",
"161604812948956251891290209840246047077",
"289805382848630685684161817409705857740",
"136173030185073682083534132779104397355",
"13252279029078914878215449838165257086",
"243530631955998550598206409992502882378",
"101117131547299071148581808841288104932",
"330688570527088811755929770767914396148"
]
},
"source": "https://github.com/microsoft/winget-cli/commit/fe424a114b6c0aa465450e3b622905e33cf3ed6d",
"target": {
"file": "src/AppInstallerCLICore/ConfigurationDynamicRuntimeFactory.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-68821-95d55436",
"digest": {
"length": 14235,
"function_hash": "169748264524454847197780721277357055676"
},
"source": "https://github.com/microsoft/winget-cli/commit/fe424a114b6c0aa465450e3b622905e33cf3ed6d",
"target": {
"file": "src/AppInstallerSharedLib/AppInstallerStrings.cpp",
"function": "MakeSuitablePathPart"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-68821-e0b01b8c",
"digest": {
"threshold": 0.9,
"line_hashes": [
"181598918430804691532767183387991605782",
"33976273560713132377692867125892121092",
"253221066215464822432227925039633360231"
]
},
"source": "https://github.com/microsoft/winget-cli/commit/fe424a114b6c0aa465450e3b622905e33cf3ed6d",
"target": {
"file": "src/AppInstallerSharedLib/Public/AppInstallerStrings.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-26T07:27:52Z"
}
}
],
"modified": "2026-10-26T07:27:52.483022176Z",
"provider": "osv",
"references": [
"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68821"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2026-68821",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 446746,
"published_at": "2026-08-11T17:19:06.54+00:00"
}