CVE-2026-0776: Discord Client Privilege Escalation Flaw

CVE-2026-0776 Overview

CVE-2026-0776 is a local privilege escalation vulnerability in the Discord Client. The flaw resides in the discord_rpc module, which loads a file from an unsecured location. An attacker with the ability to execute low-privileged code on the target host can leverage this weakness to run arbitrary code in the context of the target user. The issue was disclosed through the Trend Micro Zero Day Initiative as ZDI-CAN-27057 and tracked under advisory ZDI-26-040. It is classified under CWE-427 (Uncontrolled Search Path Element).

Critical Impact

Local attackers can escalate privileges and execute arbitrary code as the targeted Discord user by planting a malicious file in an unsecured search path used by discord_rpc.

Affected Products

• Discord Client (desktop application)
• Installations using the discord_rpc module
• Windows endpoints where Discord is installed in user-writable locations

Discovery Timeline

• 2026-01-23 - CVE-2026-0776 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-0776

Vulnerability Analysis

The vulnerability stems from how the Discord Client resolves and loads a dependency through the discord_rpc module. The application searches for a required file in a location that is not adequately protected from low-privileged users. When a process loads a library or resource from an attacker-writable directory, the operating system honors the path order and loads the planted artifact instead of the legitimate one.

Exploitation requires that an attacker already has local code execution at a low privilege level and that a user interacts with the affected client. Once the malicious file is loaded, code executes in the security context of the Discord user, inheriting that user's tokens, credentials, and access rights.

This class of flaw is commonly described as DLL search-order hijacking or untrusted search path abuse. It is impactful for desktop applications installed under per-user directories because the install path itself is typically writable by the user, broadening the attack surface available to standard accounts and to malware that lands with limited privileges.

Root Cause

The root cause is an Uncontrolled Search Path Element (CWE-427) in the discord_rpc component. The loader does not enforce a fully qualified or integrity-checked path when resolving the dependency, so any file with the expected name placed earlier in the search order is loaded without validation.

Attack Vector

The attack vector is local. An attacker first executes code as a low-privileged user, then drops a malicious file in a directory consulted by discord_rpc ahead of the legitimate file. When Discord starts or the affected code path runs, the planted artifact is loaded and its code is executed within the Discord process. Refer to the Zero Day Initiative Advisory ZDI-26-040 for additional technical context.

// No verified public exploit code is available for CVE-2026-0776.
// See ZDI-26-040 for the vendor-coordinated technical write-up.

Detection Methods for CVE-2026-0776

Indicators of Compromise

• Unexpected files matching discord_rpc dependency names placed in user-writable directories adjacent to the Discord install path.
• Discord processes loading modules from non-standard locations such as %APPDATA%, %TEMP%, or per-user profile directories.
• New or modified files in the Discord application directory created by non-installer processes.

Detection Strategies

• Monitor image and module load events for the Discord process and flag loads originating outside the expected install directory.
• Hunt for file-write events that create executables or libraries in directories used by Discord at runtime.
• Correlate Discord process launches with recent low-privileged file drops in adjacent paths to surface staging activity.

Monitoring Recommendations

• Enable command-line and module-load logging on Windows endpoints, including Sysmon Event IDs 1, 7, and 11.
• Alert on Discord child processes that spawn shells, scripting hosts, or LOLBins shortly after startup.
• Track integrity of files under the Discord install directory and notify on unexpected modifications.

How to Mitigate CVE-2026-0776

Immediate Actions Required

• Update the Discord Client to the latest version that addresses the discord_rpc search path issue.
• Restrict standard users from writing to directories consulted by Discord at load time where feasible.
• Audit endpoints for unauthorized files in Discord-related directories and remove any unknown artifacts.

Patch Information

Refer to the Zero Day Initiative Advisory ZDI-26-040 for vendor coordination details and the fixed release identifier. Apply the latest Discord Client update across all managed endpoints to remediate the vulnerability.

Workarounds

• Limit local code execution by enforcing application control policies such as Windows Defender Application Control or AppLocker.
• Remove the Discord Client from systems where it is not required for business use, particularly on shared or privileged workstations.
• Run desktop sessions under standard user accounts and prevent privilege uplift to reduce the value of a successful exploit.

# Example: enumerate suspicious files near a Discord install on Windows (PowerShell)
Get-ChildItem -Path "$env:LOCALAPPDATA\Discord" -Recurse -Include *.dll,*.node |
  Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-30) } |
  Select-Object FullName, CreationTime, Length