CVE-2026-45586: Windows Collaborative Translation Framework (CTFMON) Elevation of Privilege Vulnerability

Synopsis

A link-following (symlink/junction abuse) privilege escalation vulnerability exists in the Windows Collaborative Translation Framework (CTFMON) component, affecting Windows 10 and Windows 11 across multiple release versions. The vulnerability is reachable locally and requires only a low-privilege account, with no victim interaction needed; CVSS v3.1 scores this at 7.8 HIGH. Successful exploitation gives the attacker full read, write, and execution control at an elevated privilege level on the compromised host. Patched-image rebuilds at the fix versions listed above are available on HarborGuard for environments running affected Windows base images.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker does not need administrator or system-level credentials to trigger the vulnerability.

• Victim interactionNot required

  No victim action such as clicking a link or opening a file is needed; the attacker can execute the exploit entirely on their own.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental preconditions.

Blast Radius

• A successful attacker elevates from a low-privilege user account to a higher-privilege context, gaining the ability to read sensitive files and credentials that were previously inaccessible.
• The attacker can write to protected system paths or registry locations, enabling persistent backdoors or modification of security-critical configuration.
• The attacker gains the ability to execute code at elevated privilege, effectively taking full control of the affected Windows host.
• All three CIA dimensions are rated HIGH, so confidentiality, data integrity, and service availability of the host are each fully compromised.