CVE-2026-8036: Local privilege escalation in NI-PAL

Synopsis

An improper input validation flaw in NI-PAL (versions 26.3.0 and earlier on Windows and Linux) allows a locally authenticated user to read arbitrary system memory and escalate privileges on the affected host. The vulnerability is reached through local access and requires a low-privilege account; no network exposure or victim interaction is necessary. Successful exploitation gives an attacker elevated control over the system, enabling access to protected memory regions and potentially full privilege escalation. HarborGuard is tracking the upstream advisory and will make a patched-image rebuild available the moment NI publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no administrative or elevated credentials are needed to trigger the flaw.

• Victim interactionNot required

  The attacker can execute the exploit entirely on their own without requiring any action from another user.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, specific memory layouts, or other environmental factors need to be aligned.

Blast Radius

• Reads arbitrary system memory, exposing kernel structures, credentials, or secrets held in memory by other processes.
• Escalates from a low-privilege user account to a higher-privilege or system-level account on the affected host.
• Gains access to data owned by other users or privileged processes running on the same machine.