CVE-2026-110746 in TotalAV
Summary
by MITRE • 10/15/2026
A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the gRPC IPC authentication token, through loading IPC.dll and abuse the SYSTEM service's within TotalAV to execute arbitrary code as NT AUTHORITY\SYSTEM.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The identified vulnerability represents a critical local privilege escalation flaw within the TotalAV security software ecosystem, specifically targeting its inter-process communication (IPC) mechanisms. This issue stems from an improper implementation of authentication for gRPC-based IPC channels used by the application to facilitate communication between different components running at varying integrity levels. An unprivileged local user can exploit this weakness by forging a valid gRPC authentication token, thereby bypassing access controls that are designed to restrict such interactions to authorized processes only. The core technical flaw lies in the ability of an attacker to load IPC.dll and manipulate the authentication handshake process, effectively tricking the elevated SYSTEM service into accepting commands from a lower-privileged context as if they originated from a trusted source.
From a technical perspective, this vulnerability exploits weaknesses in how TotalAV validates incoming gRPC requests within its internal architecture. The software relies on specific DLLs to handle these communications, and by loading IPC.dll through standard Windows API calls such as LoadLibrary or similar mechanisms, an attacker can inject malicious logic into the authentication flow. Because the service operates with NT AUTHORITY\SYSTEM privileges, any code executed via this forged token inherits those highest-level permissions. This allows the execution of arbitrary commands on the host system without requiring additional elevation techniques like UAC bypasses or kernel exploits, as the privilege jump is achieved directly through the application's own trusted channel.
The operational impact of this vulnerability is severe due to its local nature and high severity rating. Once an attacker gains a foothold with standard user privileges, they can escalate their access to SYSTEM level almost immediately. This grants them full control over the operating system, enabling actions such as installing persistent backdoors, stealing sensitive data including credentials and encryption keys, disabling other security controls, or pivoting to attack other systems on the network. The ease of exploitation means that even users with minimal technical knowledge could potentially leverage existing exploit frameworks if public proof-of-concept code becomes available, significantly increasing the risk landscape for organizations relying on TotalAV for endpoint protection.
In terms of industry classification standards, this vulnerability aligns closely with CWE-269 Improper Privilege Management and CWE-787 Out-of-bounds Write or CWE-434 Unrestricted Upload of File with Dangerous Type depending on the specific mechanism used to load the DLL and execute code. It also maps directly to MITRE ATT&CK technique T1055 Process Injection, specifically under sub-techniques involving dynamic-link library injection, as well as T1068 Exploitation for Privilege Escalation. The attack vector is classified as Local (L) with low complexity and requires user interaction only in the sense that an account must exist on the target system, but no physical access or social engineering is typically needed beyond initial local access.
Mitigation strategies should focus primarily on immediate patching by updating TotalAV to a version where this authentication flaw has been remediated. Security administrators should verify that all endpoints are running the latest stable release of the software and monitor for any indicators of compromise related to unusual gRPC traffic or unexpected loading of IPC-related DLLs from non-standard directories. In environments where updates cannot be applied immediately, network segmentation can help limit lateral movement if an attacker does manage to escalate privileges, although local containment remains challenging without endpoint detection and response capabilities that specifically profile process injection behaviors.