CVE-2026-58635: Windows 10 1809 Privilege Escalation Flaw

CVE-2026-58635 Overview

CVE-2026-58635 is a command injection vulnerability in the Windows Narrator Braille component. Microsoft classifies the issue as an elevation of privilege flaw affecting supported Windows client and server releases. An authorized local attacker can inject unsanitized special elements into a command string processed by the Narrator Braille subsystem. Successful exploitation allows the attacker to execute commands at a higher privilege level than the initial user context. The weakness is tracked under CWE-77: Improper Neutralization of Special Elements used in a Command.

Critical Impact
A local, authenticated attacker can elevate privileges on affected Windows systems, gaining high impact against confidentiality, integrity, and availability.

Affected Products

Microsoft Windows 10 (1809, 21H2, 22H2) on x86, x64, and ARM64
Microsoft Windows 11 (24H2, 25H2, 26H1) on x64 and ARM64
Microsoft Windows Server 2019, 2022, and 2025

Discovery Timeline

2026-07-14 - CVE-2026-58635 published to NVD
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-58635

Vulnerability Analysis

The flaw resides in the Windows Narrator Braille accessibility component, which supports refreshable Braille displays for visually impaired users. Narrator Braille processes input that is later assembled into command strings executed by the operating system. The component fails to properly neutralize shell metacharacters and other special elements before passing the string to a command interpreter. An authorized user on the local system can craft input containing embedded command separators or shell operators. When Narrator Braille processes this input, the injected commands execute in the context of the privileged Narrator process. This yields a local elevation of privilege with high impact across confidentiality, integrity, and availability.

Root Cause

The root cause is missing input sanitization in the code path that constructs commands from Braille-related configuration or runtime data. Special elements such as &, |, ;, and quote characters are passed through to the command interpreter instead of being escaped or rejected. This maps directly to [CWE-77].

Attack Vector

Exploitation requires local access and low-privilege authenticated credentials on the target host. No user interaction beyond the attacker's own session is required. The attacker triggers the vulnerable Narrator Braille code path with a malicious payload, causing the injected commands to run at elevated privilege. The vulnerability is not remotely reachable and has no public proof of concept at the time of publication.

No verified proof-of-concept code has been published. See the Microsoft Security Update CVE-2026-58635 advisory for further technical details.

Detection Methods for CVE-2026-58635

Indicators of Compromise

Unexpected child processes spawned by Narrator.exe or Narrator Braille helper binaries, particularly cmd.exe, powershell.exe, or scripting hosts.
Creation of new local administrator accounts or scheduled tasks shortly after Narrator or Braille display activity.
Anomalous writes to system directories originating from the Narrator process tree.

Detection Strategies

Monitor process creation events (Windows Event ID 4688 or Sysmon Event ID 1) with parent image Narrator.exe and unexpected command lines.
Alert on Narrator processes invoking command interpreters or LOLBins such as rundll32.exe, regsvr32.exe, or wmic.exe.
Correlate Braille display connection or configuration change events with subsequent privileged operations.

Monitoring Recommendations

Baseline normal Narrator process behavior in the environment and treat deviations as investigation candidates.
Enable command-line auditing and PowerShell script block logging on all endpoints running affected Windows versions.
Forward endpoint telemetry to a central data lake or SIEM for retroactive hunting once patches are deployed.

How to Mitigate CVE-2026-58635

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-58635 across all affected client and server builds.
Prioritize patching multi-user hosts such as Remote Desktop Session Hosts and Virtual Desktop Infrastructure where local low-privilege access is common.
Review local user and service account inventories to identify unnecessary interactive logon rights.

Patch Information

Microsoft has issued updates for Windows 10 (1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2019, 2022, and 2025. Consult the Microsoft Security Update Guide entry for CVE-2026-58635 for KB article identifiers and build-specific package downloads.

Workarounds

Disable the Narrator feature on systems that do not require accessibility support, particularly servers and kiosk endpoints.
Restrict interactive and Remote Desktop logon rights so that only trusted users can reach the local attack surface.
Remove or restrict use of Braille display peripherals on hosts where accessibility hardware is not required.

bash

# Query Narrator service and process status via PowerShell
Get-Process -Name Narrator -ErrorAction SilentlyContinue
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} `
  | Where-Object { $_.Message -match 'Narrator.exe' } `
  | Select-Object TimeCreated, Message -First 20