---
id: CVE-2026-7006
title: >-
  Sublime Text for Windows through Build 4192 (Sublime Text 4) and Build 3207
  (Sublime Text 3) contains a local privilege escalation vulnerability that
  allows unprivileged local attackers to execute arbitrary code with elevated
  privileges …
summary: >-
  Sublime Text for Windows through Build 4192 (Sublime Text 4) and Build 3207
  (Sublime Text 3) contains a local privilege escalation vulnerability that
  allows unprivileged local attackers to execute arbitrary code with elevated
  privileges …
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-494
vendor: Sublime HQ Pty Ltd
product: Sublime Text 4
affected:
  - sublime_text_4 4192
  - sublime_text_3 3207
published: '2026-09-18'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T17:17:01.830'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-7006'
references:
  - url: 'https://gist.github.com/anthok/765b3ca0223fabee38f51d8f832e2175'
    label: disclosure@vulncheck.com
  - url: 'https://www.sublimetext.com/'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/sublime-text-4192-3207-local-privilege-escalation-via-update-staging-mechanism
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-18T16:58:47.601505Z'
ingestedAt: '2026-09-18T15:44:31.589Z'
epss: 0.00096
epssPercentile: 0.00776
---

## Overview

Sublime Text for Windows through Build 4192 (Sublime Text 4) and Build 3207 (Sublime Text 3) contains a local privilege escalation vulnerability that allows unprivileged local attackers to execute arbitrary code with elevated privileges by abusing the update staging mechanism. Attackers can place a malicious DLL in the user-writable staging directory under %LOCALAPPDATA%, mark it read-only to bypass cleanup, and have the elevated installer copy it into the protected installation directory, causing the DLL to execute in the context of any higher-privileged user who subsequently launches the application.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.