CVE-2026-75137 in UpSignOn
Summary
by MITRE • 09/02/2026
UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover cleartext vault data from process memory even after the application has been locked. Attackers can use the PROCESS_VM_READ permission to read the memory space of UpSignOn.exe and extract sensitive fields including entry names, URLs, usernames, passwords, TOTP secrets, and notes.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified in UpSignOn for Windows prior to version 7.19.0 represents a critical failure in application-level data protection mechanisms, specifically concerning the handling of sensitive credentials stored within the process memory space. This flaw allows local attackers with basic user privileges to recover cleartext vault data even after the application has been explicitly locked by the end-user. The core technical issue lies in the retention of decrypted credential material in volatile memory without adequate zeroization or obfuscation protocols once the session is ostensibly secured. When an application locks its interface, it typically aims to prevent unauthorized interaction with the user interface elements; however, this vulnerability demonstrates that such a lock does not equate to cryptographic protection of the underlying data structures residing in RAM. Consequently, any process running under the same or lower integrity level can exploit standard Windows API functions to inspect the memory footprint of the UpSignOn.exe executable.
From a technical perspective, the exploitation vector relies on the ability to obtain PROCESS_VM_READ access rights for the target process. In many default configurations and user-level contexts, this permission is granted without requiring administrative elevation or complex privilege escalation techniques. Once an attacker gains handle access with read permissions, they can map the memory space of UpSignOn.exe into their own address space using standard APIs such as ReadProcessMemory. By analyzing the heap structures where the vault data is stored in plaintext, attackers can parse out sensitive fields including entry names, associated URLs, usernames, passwords, Time-based One-Time Password (TOTP) secrets, and free-form notes. This extraction occurs entirely within memory, bypassing file system permissions or database encryption layers that might otherwise protect static storage of these credentials. The persistence of cleartext data in RAM after the application is locked indicates a fundamental design flaw where security controls are applied only at the presentation layer rather than at the data handling and cryptographic management layers.
The operational impact of this vulnerability is severe, as it effectively nullifies the confidentiality guarantees provided by password managers for local users who share system access or operate on compromised endpoints with malware capable of memory scraping. An attacker gaining physical or remote shell access to a workstation can extract all stored credentials in their original form, including TOTP secrets which are critical for multi-factor authentication bypass. The compromise of these values allows the adversary to authenticate as legitimate users across various web services and internal systems without triggering additional security alerts associated with brute-force attacks or credential stuffing. Furthermore, because the data is extracted from memory rather than disk, it evades detection by many endpoint protection solutions that focus on file integrity monitoring or static signature analysis. This aligns closely with the MITRE ATT&CK technique of Credential Dumping via Memory Scraping (T1005), where adversaries target local system information to harvest credentials for lateral movement and persistence.
To mitigate this risk, immediate action is required by upgrading UpSignOn to version 7.19.0 or later, which presumably implements proper memory zeroization upon locking the vault and restricts sensitive data retention in cleartext form. In environments where patching may be delayed, administrators should enforce stricter access control policies on process creation and handle inheritance to limit PROCESS_VM_READ permissions for non-essential processes. Additionally, deploying endpoint detection and response solutions that monitor for suspicious memory read operations against known credential manager processes can provide an additional layer of defense. From a broader security architecture perspective, this incident highlights the importance of adhering to CWE Category 200: Information Exposure, specifically CWE-798: Use of Hard-coded Credentials or CWE-312: Cleartext Storage of Sensitive Information in Memory. Security teams must ensure that password management solutions not only encrypt data at rest but also actively scrub sensitive values from volatile memory when they are no longer immediately required by the active application logic, thereby reducing the attack surface for local privilege escalation and credential theft attacks.