Loading vulnerability…
CVE-2026-58635 is an elevation of privilege vulnerability in Windows Narrator Braille caused by improper neutralization of special elements used in a command. The flaw is a command injection issue in which attacker-controlled input can be incorporated into command execution without sufficient sanitization or restriction. Successful exploitation allows a locally authorized attacker to elevate privileges on the affected Windows system.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a real local privilege escalation proof-of-concept for CVE-2026-58635 affecting Windows Narrator Braille / BRLTTY. It is not part of a major exploit framework. The repository contains three compiled C++ components plus helper PowerShell/CMD scripts for lab setup, vulnerability checking, helper retrieval, and end-to-end execution. Core exploit flow: src/brlapi_trigger.cpp dynamically loads %SystemRoot%\System32\brlapi.dll, opens a BrlAPI connection to localhost:0 with auth set to none, and writes global parameter 29 (literary braille table). The supplied value is an attacker-controlled executable path converted to BRLTTY-compatible forward-slash UTF-8 form. According to the repository, BRLTTY interprets that path as an external contraction table program and launches it as LocalService. This is the CVE-specific exploitation primitive. Stage behavior: src/localservice_stage.cpp is the payload executed as LocalService. It writes identity evidence (username/SID/PID), runs whoami /all and stores the output, then looks for sibling binaries SigmaPotato.exe and system_shell_launcher.exe. If present, it launches SigmaPotato and logs the result. src/system_shell_launcher.cpp duplicates the current token, retargets it to the active console session, builds an environment block, and calls CreateProcessAsUserW to open cmd.exe in a new console titled 'CVE-2026-58635 SYSTEM SHELL'. This makes the repository more than a bare PoC: it includes an operational post-exploitation chain from LocalService to SYSTEM, though the second stage depends on SeImpersonatePrivilege and an external helper. Supporting scripts: scripts/Check-Vulnerability.ps1 is a read-only detection/preflight script that checks OS build, UBR, Accessibility.Braille capability state, BrlAPI service registration, and hashes of installed components; it does not exploit the issue. scripts/Prepare-Lab.ps1 installs the optional Braille capability and adjusts ACLs so Users can execute the repo and LocalService can write results. scripts/Get-SigmaPotato.ps1 downloads a pinned SigmaPotato v1.2.6 release from GitHub and verifies its SHA-256. scripts/Run-PoC.cmd orchestrates the full demonstration from a standard user context by starting the BrlAPI service, invoking brlapi_trigger.exe against localservice_stage.exe, waiting for execution, and printing collected evidence. scripts/Clear-Results.cmd removes generated artifacts. Repository structure is clean and purpose-built: src/ contains the exploit and stages, scripts/ contains operational helpers, third_party/SigmaPotato/ contains attribution/license metadata only, and SHA256SUMS documents expected hashes for produced binaries and the helper. Overall capability: local authenticated user to LocalService code execution via BrlAPI/BRLTTY command injection, with optional LocalService-to-SYSTEM escalation and interactive shell creation.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.