CVE-2026-55567: BleachBit Privilege Escalation Vulnerability

CVE-2026-55567 Overview

BleachBit is an open-source disk cleaner and privacy tool used on Windows and Linux systems. Versions prior to 6.0.1 contain a time-of-check to time-of-use (TOCTOU) flaw in the Windows privileged cleaning routine. The elevated cleaner does not lock and validate a target's parent directory before performing deletion. A local unprivileged user can replace that directory with a Windows junction and use a native symbolic link to redirect the elevated deletion to an attacker-controlled path. Chained with Windows Installer rollback behavior, the arbitrary privileged file deletion leads to local SYSTEM privilege escalation. The issue is fixed in BleachBit 6.0.1.

Critical Impact

A local, low-privileged Windows user can escalate to SYSTEM by redirecting BleachBit's privileged cleaner to delete an attacker-chosen file.

Affected Products

• BleachBit for Windows, all versions prior to 6.0.1
• Deployments where BleachBit runs with elevated (administrative) privileges
• Multi-user Windows systems with BleachBit installed

Discovery Timeline

• 2026-09-21 - CVE-2026-55567 published to the National Vulnerability Database (NVD)
• 2026-09-24 - Last updated in NVD database
• Fix released - BleachBit v6.0.1 via Pull Request #1774 and GitHub Security Advisory GHSA-vcjw-px28-5w94

Technical Details for CVE-2026-55567

Vulnerability Analysis

The flaw is a TOCTOU race in BleachBit's Windows privileged deletion code path, classified as [CWE-367]. The elevated cleaner resolves a target path and later performs a deletion, but does not hold an exclusive handle on the parent directory between validation and the delete syscall. During that window a local user can swap the parent directory for a Windows junction that redirects filesystem operations elsewhere. A native NTFS symbolic link inside the redirected target then causes the SYSTEM-level deletion to remove a file the attacker selects.

Root Cause

BleachBit's Windows cleanup routines call the underlying delete function without first opening and locking the parent directory. Because directory reparse points (junctions) can be created by non-privileged users, the cleaner cannot trust the resolved path when it runs elevated. Without an exclusive lock, an attacker wins the race between path resolution and deletion.

Attack Vector

Exploitation requires local access with an interactive user session on a Windows host where BleachBit runs with administrative privileges. The attacker prepares a directory the elevated cleaner will process, replaces it with a junction pointing at a sensitive location, and plants a symbolic link inside. The elevated deletion is redirected to a file chosen by the attacker. Combined with Windows Installer rollback primitives, arbitrary file deletion by SYSTEM is converted into full SYSTEM code execution.

# Security patch in bleachbit/FileUtilities.py - lock parent directory before deletion
def _delete_path(path, delete_func):
    """
    Delete a path with parent lock if on Windows.
    """
    if os.name == 'nt':
        return bleachbit.Windows.with_parent_lock(path, delete_func, path)
    return delete_func(path)


def _run_with_delete_lock(path, func):
    """Run a function with a lock on the parent directory of pathname.

    This prevents race conditions where the parent directory is deleted
    while the function is running.
    """
    if os.name == 'nt':
        return bleachbit.Windows.with_parent_lock(path, func)
    return func()


def close_delete_parent_lock():
    """Close the delete parent lock if on Windows."""
    if os.name == 'nt':
        bleachbit.Windows._close_delete_parent_lock()

Source: GitHub commit ee12823

Detection Methods for CVE-2026-55567

Indicators of Compromise

• Creation of NTFS junctions or symbolic links in directories that BleachBit is configured to clean, especially by non-administrative users.
• BleachBit privileged process (bleachbit.exe) opening or deleting files outside its expected working directories.
• Unexpected deletion of files owned by SYSTEM or located in C:\Windows\, C:\Program Files\, or installer rollback directories.
• New SYSTEM-owned processes spawned in the same session where BleachBit was executed elevated.

Detection Strategies

• Monitor Sysmon Event ID 11 (FileCreate) for reparse point creation by unprivileged users in cleaner-target paths.
• Alert on Sysmon Event ID 23 (FileDelete) where the deleting process is BleachBit and the target path is outside temp or user profile locations.
• Correlate elevated BleachBit executions with subsequent Windows Installer rollback file operations affecting privileged paths.

Monitoring Recommendations

• Enable object-access auditing on directories BleachBit cleans and forward events to a centralized SIEM.
• Track installed versions of BleachBit across the fleet and flag hosts running versions earlier than 6.0.1.
• Baseline normal cleaner file-deletion behavior and alert on deviations, particularly writes to %SYSTEMROOT% and %PROGRAMFILES%.

How to Mitigate CVE-2026-55567

Immediate Actions Required

• Upgrade all Windows installations of BleachBit to version 6.0.1 or later.
• Restrict who can launch BleachBit elevated; do not permit standard users to invoke the privileged cleaner.
• Audit endpoints for pre-existing junctions in directories BleachBit targets and remove suspicious reparse points.

Patch Information

The fix is available in BleachBit v6.0.1. The patch introduces _delete_path and with_parent_lock helpers that hold an exclusive handle on the parent directory during deletion, eliminating the TOCTOU window. See Pull Request #1774 and GitHub Security Advisory GHSA-vcjw-px28-5w94 for full technical details.

Workarounds

• Run BleachBit only under a dedicated administrator account, not from standard user sessions.
• Remove BleachBit shortcuts and scheduled tasks that trigger the elevated cleaner from shared or multi-user hosts.
• Configure cleaner targets to exclude directories writable by unprivileged users until patching is complete.

# Verify installed BleachBit version on Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "BleachBit*" } |
  Select-Object DisplayName, DisplayVersion, InstallLocation

# Silent upgrade to the patched release
Start-Process -FilePath "BleachBit-6.0.1-setup.exe" -ArgumentList "/S" -Wait