CVE-2026-12410 Overview
CVE-2026-12410 is a link following vulnerability in the Uninstaller component of CCleaner on Windows. The flaw affects CCleaner versions prior to 7.10.1464. A local, low-privileged attacker can escalate privileges to SYSTEM by creating a symlink or NTFS junction during application uninstallation. CCleaner follows the crafted link when deleting the application's data folder with elevated integrity, enabling arbitrary file deletion or manipulation in privileged locations. The issue is categorized under CWE-59 (Improper Link Resolution Before File Access).
Critical Impact
A local, low-privileged user can escalate to SYSTEM on Windows hosts running vulnerable CCleaner versions by abusing symlink/junction handling in the Uninstaller.
Affected Products
- CCleaner for Windows versions prior to 7.10.1464
- CCleaner Uninstaller component
- Windows endpoints where CCleaner runs uninstallation with elevated integrity
Discovery Timeline
- 2026-08-05 - CVE-2026-12410 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-12410
Vulnerability Analysis
The vulnerability resides in the Uninstaller component of CCleaner on Windows. During uninstallation, CCleaner deletes an application's data folder while running with elevated integrity. The Uninstaller does not validate whether the target path is a legitimate directory or a reparse point. An attacker who controls the pre-deletion state of the folder can substitute a symlink or NTFS junction that redirects file operations to a privileged location.
Because the deletion operation executes as SYSTEM, the attacker inherits the ability to remove or manipulate arbitrary files. This class of primitive is a well-known building block for local privilege escalation on Windows, often chained with DLL planting or service binary replacement to gain code execution as SYSTEM.
Root Cause
The root cause is improper link resolution before file access [CWE-59]. The Uninstaller trusts filesystem paths under a low-privilege user's control and follows reparse points without verifying the final target. This mismatch between path resolution context and privilege context creates the escalation path.
Attack Vector
Exploitation requires local access with low privileges and no user interaction. The attacker prepares a symlink or junction in a directory that CCleaner will process during uninstallation. When CCleaner performs the elevated deletion, it follows the link and operates on attacker-chosen targets outside the intended scope. The vulnerability is described in the Gen Digital Security Advisory.
Detection Methods for CVE-2026-12410
Indicators of Compromise
- Creation of NTFS junctions or symbolic links inside CCleaner or application data directories by non-administrative users prior to uninstallation events.
- Unexpected deletion or modification of files in privileged directories such as C:\Windows\System32 or C:\Program Files correlated with CCleaner uninstall activity.
- CCleaner Uninstaller process (CCleaner.exe or associated uninstaller binary) performing file operations on paths outside its expected working directories.
Detection Strategies
- Monitor process telemetry for CCleaner uninstaller processes accessing reparse points using APIs such as CreateFile with FILE_FLAG_OPEN_REPARSE_POINT cleared.
- Alert on mklink invocations or use of CreateSymbolicLink/DeviceIoControl with FSCTL_SET_REPARSE_POINT by low-privileged users targeting CCleaner data directories.
- Correlate elevated file deletions with preceding link-creation events in user-writable folders.
Monitoring Recommendations
- Enable Windows Sysmon Event ID 11 (FileCreate) and Event ID 2 (file creation time change) to capture reparse point creation.
- Ingest endpoint file and process telemetry into a centralized data lake to identify TOCTOU patterns preceding privilege escalation.
- Track CCleaner version inventory across the fleet to identify hosts still running versions below 7.10.1464.
How to Mitigate CVE-2026-12410
Immediate Actions Required
- Upgrade CCleaner to version 7.10.1464 or later on all Windows endpoints.
- Restrict CCleaner uninstallation to administrators until patched to reduce exposure to low-privileged abuse.
- Audit installed CCleaner versions across the environment and prioritize remediation on multi-user systems.
Patch Information
Gen Digital has released CCleaner 7.10.1464, which addresses the link-following behavior in the Uninstaller component. Refer to the Gen Digital Security Advisory for release details and vendor guidance.
Workarounds
- Remove CCleaner from shared or multi-user Windows hosts where non-administrative users can stage symlinks or junctions.
- Apply least-privilege controls to limit which users can create reparse points on affected systems using SeCreateSymbolicLinkPrivilege restrictions.
- Block execution of the vulnerable CCleaner uninstaller via application control policies until patching is complete.
# Configuration example: audit which accounts hold SeCreateSymbolicLinkPrivilege
secedit /export /cfg C:\Temp\secpol.cfg
findstr /I "SeCreateSymbolicLinkPrivilege" C:\Temp\secpol.cfg
# Query installed CCleaner version on a host
reg query "HKLM\SOFTWARE\Piriform\CCleaner" /v Version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
