CVE-2026-48565: Windows Narrator Braille Elevation of Privilege Vulnerability

Synopsis

An untrusted search path vulnerability in Windows Narrator Braille allows a local attacker to escalate their privileges on the affected system. The attack is launched locally and requires only a low-privilege account; no network access or victim interaction is needed. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability on the host. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as Microsoft publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network-facing exposure is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker does not need administrative credentials.

• Victim interactionNot required

  No user action such as clicking a link or opening a file is needed to trigger the vulnerability.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions, special memory layout, or environmental prerequisites.

Blast Radius

• A successful attacker reads protected files, credentials, or secrets stored on the host that are inaccessible to their original low-privilege account.
• The attacker writes or modifies system files, registry entries, or persisted configuration, enabling persistent backdoors or tampering with security controls.
• The attacker can crash or terminate system processes, causing service disruption on the affected host.
• Full privilege escalation to a higher-privileged context means any subsequent action on the host, including lateral movement setup, is within reach.