Windows WalletService Flaw Enables SYSTEM Privilege Escalation
A critical privilege escalation vulnerability in Windows WalletService allows standard users to gain SYSTEM privileges by manipulating DLL loading.
Microsoft has patched a significant local privilege escalation vulnerability affecting the Windows WalletService, a component of the public Windows Wallet WinRT API. The flaw, identified as CVE-2026-49176, could allow a low-privileged user to gain complete control over an affected system, operating with the highest local privileges as NT AUTHORITY\SYSTEM. This vulnerability was discovered by Chen Le Qi and Mochi Nishimiya from STAR Labs SG.
The attack vector exploits how WalletService processes API requests. When a standard user manipulates the path of their Documents folder, they can trick WalletService into loading a malicious DLL. The service, which runs with SYSTEM privileges, appends a fixed directory name to this user-controlled path and attempts to open a file named wallet.db. This creates a trust boundary where the service, despite its elevated privileges, uses a path influenced by a regular user.
Researchers found that by creating a specially crafted wallet.db file containing specific ESE (Extensible Storage Engine) metadata, an attacker can instruct the database engine to load a DLL and execute a specified function. This feature, intended for trusted databases, is leveraged by WalletService before it fully opens a database located in a user-controlled path. The malicious wallet.db can point to a DLL controlled by the attacker.
When WalletService opens this malicious database with its SYSTEM privileges, the ESE engine loads the attacker's DLL within the WalletService process, which typically runs under svchost.exe as SYSTEM. This grants the attacker code execution at the highest local privilege level. Security researcher David Carlier demonstrated a successful exploit that injected a SYSTEM token into the active desktop session, spawning an interactive SYSTEM command prompt.
Crucially, this exploit does not rely on memory corruption, race conditions, or prior administrator privileges. It solely depends on WalletService's trust in a database path derived from a user-redirected Documents folder. This makes it a potent threat for attackers seeking to escalate privileges on compromised Windows systems.
Microsoft has addressed this vulnerability through its July 2026 security update. The patch implements a mitigation called WalletServiceRedirectionGuard, which effectively disables the affected legacy WalletService database path. On patched systems, WalletService will no longer open wallet.db or process persisted callbacks from user-controlled locations, thus preventing the DLL loading mechanism.
While the vulnerability is now patched, organizations are advised to apply Microsoft's security updates promptly. Security teams should also remain vigilant for suspicious activities, including unusual changes to per-user Documents folder mappings, unexpected access to wallet.db files outside of standard user profiles, and svchost.exe processes associated with WalletService loading DLLs from user-writable directories. The appearance of short-lived SYSTEM services or SYSTEM-launched command shells in interactive sessions could also indicate exploitation attempts.
This incident highlights the ongoing challenges in securing Windows components that interact with user-controlled paths and file system operations. The ability to leverage seemingly innocuous components like WalletService for privilege escalation underscores the importance of robust security patching and continuous monitoring for anomalous system behavior.