CVE-2026-7006: Sublime Text Privilege Escalation Vulnerability

CVE-2026-7006 Overview

CVE-2026-7006 is a local privilege escalation vulnerability affecting Sublime Text for Windows through Build 4192 (Sublime Text 4) and Build 3207 (Sublime Text 3). The flaw resides in the application's update staging mechanism, which trusts files placed in a user-writable directory under %LOCALAPPDATA%. An unprivileged local attacker can plant a malicious Dynamic Link Library (DLL) in the staging path, set it read-only to bypass cleanup routines, and cause the elevated installer to copy it into the protected installation directory. When a higher-privileged user subsequently launches Sublime Text, the planted DLL executes in that user's security context.

Critical Impact
Any low-privileged user on a shared Windows workstation can achieve arbitrary code execution in the context of administrators or other higher-privileged users who later launch Sublime Text.

Affected Products

Sublime Text 4 for Windows through Build 4192
Sublime Text 3 for Windows through Build 3207
Windows systems where Sublime Text is installed in a protected directory and updated via the built-in staging mechanism

Discovery Timeline

2026-09-18 - CVE-2026-7006 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-7006

Vulnerability Analysis

CVE-2026-7006 is a local privilege escalation issue rooted in the download of code without integrity check weakness class [CWE-494]. Sublime Text stages update payloads inside a directory under %LOCALAPPDATA% that any unprivileged user can write to. The elevated installer component consumes files from that staging directory and copies them into the protected installation path without verifying integrity or ownership.

An attacker plants a malicious DLL in the staging directory before the elevated install step runs. Marking the file read-only prevents the installer from cleaning up or overwriting the planted payload. The installer then copies the attacker-controlled DLL into the trusted installation directory. When any higher-privileged user launches Sublime Text, the process loads the planted DLL and executes attacker code with that user's privileges.

Root Cause

The root cause is a trust boundary violation between an unprivileged staging location and an elevated installer. The installer treats staged content as authoritative and does not validate signatures, hashes, or the security descriptor of files it promotes into Program Files. Combined with the read-only bypass of the cleanup logic, this allows persistent placement of untrusted code into a privileged path.

Attack Vector

Exploitation requires local access and low privileges on the target Windows host, plus an interaction from a higher-privileged user who launches Sublime Text after the plant. The attack does not require network access, and no memory corruption is involved. A working proof-of-concept has been published as a GitHub Gist PoC, and the flaw is documented in the VulnCheck Advisory #4192.

// No verified exploit code reproduced here. See the linked PoC for details.
// High-level flow:
//   1. Attacker writes malicious.dll to the Sublime Text staging directory under %LOCALAPPDATA%.
//   2. Attacker sets the file attribute to read-only to defeat cleanup.
//   3. Elevated installer copies the DLL into the protected install directory.
//   4. Higher-privileged user launches sublime_text.exe and loads the planted DLL.

Detection Methods for CVE-2026-7006

Indicators of Compromise

Unexpected DLL files present in the Sublime Text staging directory under %LOCALAPPDATA%\Sublime Text\ written by non-administrative users.
DLL files in the Sublime Text installation directory whose Authenticode signature does not match Sublime HQ Pty Ltd or whose hash does not match a known good build.
File attribute changes setting staged files to read-only shortly before a Sublime Text update runs.
sublime_text.exe loading modules from paths that were recently modified by a standard user account.

Detection Strategies

Monitor process image loads for sublime_text.exe and alert on DLLs whose on-disk hash is not on an allow list of known Sublime Text components.
Correlate file-write events by non-privileged users into the Sublime Text staging directory with subsequent file-copy events performed by the elevated updater process.
Flag any DLL created in Program Files\Sublime Text\ that lacks a valid vendor signature.

Monitoring Recommendations

Enable Windows Sysmon Event IDs 7 (Image Loaded) and 11 (FileCreate) with rules scoped to the Sublime Text install and staging paths.
Ingest endpoint file and process telemetry into a centralized SIEM or data lake and retain at least 30 days for retrospective hunts.
Baseline the expected DLL set shipped with each Sublime Text build and alert on deviations after an update event.

How to Mitigate CVE-2026-7006

Immediate Actions Required

Upgrade Sublime Text to a build later than 4192 (Sublime Text 4) or later than 3207 (Sublime Text 3) once a fixed release is published by the vendor. Confirm current status on the Sublime Text Official Site.
Inventory Windows endpoints running Sublime Text and prioritize multi-user systems, jump hosts, and developer workstations.
Inspect the Sublime Text staging directory under %LOCALAPPDATA% on affected hosts for unexpected DLLs and remove any that are not vendor-signed.

Patch Information

Refer to the VulnCheck Advisory #4192 and the Sublime Text Official Site for the latest fixed build information. Apply vendor-provided updates through your standard software deployment process and validate that the staging directory is emptied after installation.

Workarounds

Restrict write access to the Sublime Text staging directory under %LOCALAPPDATA% using NTFS Access Control Lists (ACLs) where feasible, or block execution of DLLs from that path via Windows Defender Application Control or AppLocker.
Disable the built-in auto-update mechanism and distribute Sublime Text updates through a managed software deployment tool that validates vendor signatures.
Avoid launching Sublime Text as an administrator or under privileged service accounts on shared systems until a patched build is deployed.

bash

# Example AppLocker rule concept (PowerShell) to block unsigned DLL loads
# from the Sublime Text staging directory. Adapt paths and GPO scope to your environment.
New-AppLockerPolicy -RuleType Dll -User Everyone `
  -Path "$env:LOCALAPPDATA\Sublime Text\*.dll" `
  -Optimize -Xml | Out-File .\block-sublime-staging.xml