CVE-2026-68821

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-68821

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68821.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-68821

Published

2026-08-11T17:19:06Z

Modified

2026-08-31T08:16:46Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

Improper privilege management in Windows Package Manager allows an authorized attacker to elevate privileges locally.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68821

Affected packages

Git / github.com/microsoft/winget-cli

Affected ranges

Type

GIT

Repo

https://github.com/microsoft/winget-cli

Events

Introduced

Fixed

fe424a114b6c0aa465450e3b622905e33cf3ed6d

Database specific

Show details

{
    "cpe": "cpe:2.3:a:microsoft:app_installer:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.29.280"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v-0.*

v-0.2.10191-preview

v-0.2.10771-preview

v-0.2.10971-preview

v-0.3.11102-preview

v-0.3.11201-preview

v-0.4.11391-preview

v.*

v.1.3.1611

v.1.3.1661-preview

v0.*

v0.1.41821-preview

v0.1.42241-preview

v0.1.4331-preview

v0.2.2941-preview

v0.2.3162-preview

v1.*

v1.0.11451

v1.0.11692

v1.0.12576

v1.10.30-preview

v1.10.40-preview

v1.11.180-preview

v1.11.190-preview

v1.11.200-preview

v1.11.210-preview

v1.11.220-preview

v1.11.230-preview

v1.11.320-preview

v1.11.350-preview

v1.11.370-preview

v1.11.400

v1.12.100-preview

v1.12.170-preview

v1.12.210-preview

v1.12.240-preview

v1.12.250-preview

v1.2.3411-preview

v1.28.100-preview

v1.28.110-preview

v1.28.90-preview

v1.29.140-preview

v1.29.160-preview

v1.29.170-preview

v1.29.20-preview

v1.29.240

v1.29.250

v1.29.30-preview

v1.29.50-preview

v1.29.70-preview

v1.3.1251-preview

v1.3.1391-preview

v1.3.1611

v1.3.1661-preview

v1.3.431

v1.4.10052

v1.4.2011-preview

v1.4.2161-preview

v1.4.3132-preview

v1.4.3531

v1.5.101-preview

v1.5.1081-preview

v1.5.1361-preview

v1.5.1572

v1.5.441-preview

v1.6.1573-preview

v1.6.2291-preview

v1.6.2482

v1.6.2631

v1.7.10514

v1.7.2491-preview

v1.7.2711-preview

v1.7.2722-preview

v1.7.2782-preview

v1.7.3172-preview

v1.7.3452-preview

v1.7.3481-preview

v1.8.1133-preview

v1.8.1522

v1.8.532-preview

v1.8.924-preview

v1.9.1551-preview

v1.9.1763-preview

v1.9.1792-preview

v1.9.1981-preview

v1.9.2151-preview

v1.9.2411-preview

v1.9.2507

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68821.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "111663460331716961421611083460455081241",
                "274888525669408001879448420251146448563",
                "287421967737626575517269826003325284191"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-68821-4eeda43b",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/microsoft/winget-cli/commit/fe424a114b6c0aa465450e3b622905e33cf3ed6d",
        "target": {
            "file": "src/AppInstallerSharedLib/AppInstallerStrings.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "132494067554770812465553683740565671131",
                "161604812948956251891290209840246047077",
                "289805382848630685684161817409705857740",
                "136173030185073682083534132779104397355",
                "13252279029078914878215449838165257086",
                "243530631955998550598206409992502882378",
                "101117131547299071148581808841288104932",
                "330688570527088811755929770767914396148"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-68821-690c1da0",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/microsoft/winget-cli/commit/fe424a114b6c0aa465450e3b622905e33cf3ed6d",
        "target": {
            "file": "src/AppInstallerCLICore/ConfigurationDynamicRuntimeFactory.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "169748264524454847197780721277357055676",
            "length": 14235
        },
        "id": "CVE-2026-68821-95d55436",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/microsoft/winget-cli/commit/fe424a114b6c0aa465450e3b622905e33cf3ed6d",
        "target": {
            "file": "src/AppInstallerSharedLib/AppInstallerStrings.cpp",
            "function": "MakeSuitablePathPart"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "181598918430804691532767183387991605782",
                "33976273560713132377692867125892121092",
                "253221066215464822432227925039633360231"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-68821-e0b01b8c",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/microsoft/winget-cli/commit/fe424a114b6c0aa465450e3b622905e33cf3ed6d",
        "target": {
            "file": "src/AppInstallerSharedLib/Public/AppInstallerStrings.h"
        }
    }
]

vanir_signatures_modified

"2026-08-31T08:16:46Z"