Windows WalletService Flaw Lets Standard Users Gain SYSTEM Privileges

Microsoft Windows WalletService is affected by a local privilege escalation vulnerability tracked as CVE-2026-49176. This flaw could allow a standard authenticated user to obtain SYSTEM-level privileges.

The vulnerability arises from WalletService’s handling of user-controlled file paths during initialization. An attacker can exploit this by redirecting the service to a maliciously crafted Extensible Storage Engine (ESE) database, which can then load an attacker-controlled callback DLL.

Windows WalletService Flaw

Researchers David Carliez demonstrated an exploit chain that begins with a low-privileged user setting up a directory structure and preparing a crafted ESE database in a controlled location.

The attacker then redirects the user’s Documents folder path to this run directory before invoking WalletService through a publicly accessible Windows Runtime (WinRT) interface.

Notably, this process does not require administrative privileges, interactive approval from an elevated user, or direct modification of protected system locations.

The proof of concept involves invoking Windows.ApplicationModel.Wallet.WalletManager.RequestStoreAsync() to acquire a Wallet item store object, followed by the GetItemsAsync() method.

While GetItemsAsync() typically enumerates wallet entries, researchers found it is sufficient to trigger WalletService initialization. During this startup process, the service opens its backing database. It accesses the mandatory Cards table before conventional item enumeration is completed.

If WalletService resolves the redirected Documents path and opens the attacker-seeded database, the malicious database configuration can force the service to load a callback DLL.

Since WalletService operates in the LocalSystem security context, the DLL executes with NT AUTHORITY\SYSTEM privileges. The final stage of the demonstrated exploit transfers or duplicates the resulting SYSTEM access token into the active desktop session, allowing the attacker to launch a process with complete local control of the affected Windows host.

The operational design of the exploit includes cleanup logic intended to reduce visible artifacts and prevent the affected account from remaining in a redirected state.

The trigger records the original Documents folder location, temporarily changes it to the attacker-controlled run root, and restores the initial location within a finally block. This restoration occurs whether the exploitation succeeds, fails, or runs against a patched build.

CVE-2026-49176 is particularly significant in environments such as shared workstations, enterprise endpoints, virtual desktops, and kiosks, where a low-privileged user account could turn local access into complete system compromise.

SYSTEM-level execution can enable credential theft, tampering with security tools, persistence installation, lateral movement preparation, and access to data belonging to other users on the device.

Defenders should prioritize applying Microsoft’s security updates for CVE-2026-49176 wherever possible, and inventory systems on Windows builds that expose WalletService functionality.

Detection engineering teams should monitor for unusual redirections of the Documents folder, abnormal WalletService launches following WinRT Wallet API activity, unexpected ESE database access from user-controlled paths, and DLL loads by WalletService from non-standard directories.

Endpoint telemetry should also flag processes spawned with SYSTEM tokens in interactive user sessions, especially when preceded by Wallet-related API calls or changes to profile paths.

ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.