CVE-2026-75135 in UpSignOn
Summary
by MITRE • 09/02/2026
UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover the master password and decrypt vault contents by reading a retained backup key from the process memory of UpSignOn.exe, even after the vault has been re-locked. Attackers can extract the backup key from process memory to decrypt the encrypted master password backup stored in v6-vault1.DATA.txt, then use the recovered master password to decrypt the main vault and export all password manager entries in cleartext.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified within UpSignOn for Windows versions prior to 7.19.0 represents a critical failure in memory management practices that leads to the exposure of highly sensitive cryptographic material. This flaw allows local attackers with basic execution privileges to recover the master password and subsequently decrypt all contents stored within the application's vault. The core technical issue stems from how the UpSignOn.exe process handles its encryption keys during runtime operations, specifically regarding the lifecycle management of backup keys used for restoring access in case of primary key loss or corruption. Instead of securely erasing these sensitive values from volatile memory after they have served their immediate purpose, the application retains them within the process address space even after the user has explicitly locked the vault and terminated active sessions involving those keys.
From a technical perspective, this behavior constitutes an improper cleanup of cryptographic secrets in non-volatile storage contexts such as RAM dumps or through direct memory reading tools available to local users. When UpSignOn loads data for decryption operations, it retrieves backup encryption keys from secure storage into the process memory buffer. Under normal security expectations, these buffers should be zeroed out immediately after use to prevent residual data leakage. However, due to this implementation flaw, the master password backup key remains accessible in plaintext within the virtual address space of UpSignOn.exe long after the vault has been re-locked. This persistence allows an attacker with local access to utilize standard memory scraping techniques or specialized forensic tools to scan the process memory for recognizable patterns associated with encryption keys and hashed passwords.
The operational impact of this vulnerability is severe, as it effectively nullifies the confidentiality guarantees provided by the password manager's encryption layer. An attacker who successfully extracts the retained backup key from the UpSignOn.exe process memory can then proceed to decrypt the file named v6-vault1.DATA.txt. This specific data file contains an encrypted version of the user's master password, which is protected using the aforementioned backup key. Once the master password is recovered in cleartext, the attacker gains full administrative access to the entire vault. This enables the exfiltration of all stored credentials, including usernames, passwords for various online services, secure notes, and potentially two-factor authentication secrets if they are stored within the same encrypted database structure. The ability to export these entries in cleartext means that sensitive corporate or personal information can be harvested without triggering any alert mechanisms related to login attempts or unauthorized access events.
This vulnerability aligns with several established industry standards for classifying security flaws. It is primarily categorized under CWE-312, which describes the storage of secrets in memory where they may be exposed through core dumps or other means. Furthermore, because it involves accessing sensitive information from a running process without proper authorization controls over that specific data segment, it also relates to CWE-798, involving the use of hardcoded credentials or excessive privileges leading to exposure. In terms of offensive security frameworks such as MITRE ATT&CK, this flaw facilitates techniques associated with Credential Dumping and Data from Local System Memory, allowing adversaries to pivot from local execution to widespread credential compromise across multiple systems where these passwords are reused.
Mitigation for this issue requires immediate action by both the software vendor and end-users until an updated version is deployed. The primary remediation strategy involves upgrading UpSignOn to version 7.19.0 or later, which addresses the memory management flaw by ensuring that backup keys are securely wiped from process memory immediately after their use in decryption operations. For organizations still running older versions, implementing strict endpoint detection and response policies can help monitor for unusual memory access patterns associated with credential dumping tools. Additionally, users should be advised to change their master passwords regularly and avoid reusing them across different platforms to limit the blast radius of a potential compromise. Enabling multi-factor authentication on critical accounts protected by this password manager adds an additional layer of defense that remains effective even if static credentials are stolen via memory scraping techniques.