Critical WalletService Flaw (CVE-2024-XXXX) Lets Attackers Control Windows Systems

Key Takeaways

• A critical local privilege escalation flaw (CVE-2026-49176) has been discovered in Microsoft’s WalletService on Windows.
• The vulnerability allows a standard user to gain full NT AUTHORITYSYSTEM control over an affected machine.
• The flaw, rated with a CVSS score of 7.8 (Important), stems from improper privilege management and unsafe file path resolution.
• Microsoft has released a patch in its July 2026 update to mitigate the issue.

Microsoft has recently addressed a significant local privilege escalation vulnerability within its Windows WalletService, identified as CVE-2026-49176. This flaw could enable an attacker operating with standard user privileges to seize complete control of a compromised system, achieving the highest level of access as NT AUTHORITYSYSTEM.

The vulnerability specifically targets WalletService, a core LocalSystem component integral to the public Windows Wallet WinRT API. Microsoft has categorized this issue as “Important,” assigning it a CVSS score of 7.8, highlighting its severe implications for system security. The underlying problems are rooted in improper privilege management and insecure file path resolution.

Credit for the discovery of this critical vulnerability goes to Chen Le Qi and Mochi Nishimiya from STAR Labs SG. The attack sequence initiates when a low-privileged user modifies the location of their “Documents” known folder.

WalletService processes requests from the Wallet API using the caller’s specified Documents path. However, a critical security lapse occurs as the service then ceases to impersonate the user, continuing its operations with elevated LocalSystem privileges. It proceeds to append a predefined “Wallet” directory name and attempts to open a file named “wallet.db” with these elevated permissions.

This creates a dangerous trust boundary. Despite the service running under the highly privileged LocalSystem account, the path to the database can be manipulated by a standard user through their redirected Documents folder mapping. An attacker can exploit this by setting up a malicious Wallet directory containing a specially crafted Extensible Storage Engine (ESE) database, which is then triggered by the service.

WalletService Privilege Escalation Mechanics

The public Wallet API serves as the initial entry point for the attack. A standard user can leverage this API to request a Wallet store and list its items. This action prompts WalletService to initialize its database. While researchers confirmed that direct activation of private Wallet components is restricted, the publicly supported API still funnels into the same privileged initialization process, creating the vulnerability.

The core of the issue lies within ESE persisted callbacks. ESE databases possess the capability to embed metadata that directs the database engine to load a Dynamic Link Library (DLL) and invoke a specific exported function. Although this feature is intended for use with trusted databases, WalletService erroneously permits persisted callbacks when opening a database supplied via a user-controlled path.

An attacker can craft a “wallet.db” file containing the necessary “Cards” table and a callback reference pointing to a malicious DLL under their control. When WalletService, operating with LocalSystem privileges, opens this database, ESE resolves the callback. This action causes the malicious DLL to be loaded within the WalletService process, which typically runs as an svchost.exe instance under the SYSTEM account. This ultimately grants the attacker code execution capabilities at the highest local privilege level.

GitHub researcher David Carlier demonstrated the efficacy of this exploit. Carlier showed how a loaded DLL could verify its SYSTEM context and subsequently inject a SYSTEM token into the active desktop session, resulting in the spawning of an interactive NT AUTHORITYSYSTEM command prompt.

Crucially, this exploit does not depend on complex techniques like memory corruption, race conditions, or requiring existing administrator privileges. Its success hinges solely on WalletService’s misplaced trust in a database located in a path derived from a standard user’s redirected Documents folder.

To address CVE-2026-49176, Microsoft’s July 2026 update introduces a mitigation feature called WalletServiceRedirectionGuard. This update effectively disables the vulnerable legacy WalletService database path. On systems that have been patched, WalletService may still create an empty Wallet directory, but it will no longer open “wallet.db,” create ESE support files, modify directory permissions, or process persisted callbacks, thereby neutralizing the exploit path.

What You Should Do

• Apply Microsoft’s security updates promptly, specifically the July 2026 patch for CVE-2026-49176.
• Monitor for any unusual or unauthorized changes to per-user Documents folder mappings.
• Keep an eye on WalletService attempting to access “wallet.db” files outside of expected user profile locations.
• Investigate instances of svchost.exe processes, particularly those hosted by WalletService, loading DLLs from user-writable folders.
• Be vigilant for the presence of short-lived SYSTEM services or command shells launched with SYSTEM privileges in interactive user sessions, as these could indicate exploitation attempts.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.