CVE-2026-41527

KDE Kleopatra versions prior to 26.08.0 on Windows contain a privilege escalation vulnerability stemming from a flawed mechanism (KUniqueService) designed to enforce single-instance execution. A local attacker can exploit this flaw to assume the privileges of an active Kleopatra user without requiring authentication or user interaction. The vulnerability presents a medium severity risk with a CVSS score of 6.9. It requires local access to the target system and involves moderate attack complexity, but successful exploitation would grant an attacker high confidentiality and integrity compromise, alongside limited availability impact. The attack surface is limited to Windows systems and does not involve network-based exploitation vectors. There is currently no evidence of active exploitation in the wild, with the vulnerability absent from the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 0.000120000 indicates minimal likelihood of near-term exploitation relative to other CVEs, and the vulnerability remains on the inactive portion of exploit tracking lists. Organizations should prioritize patching to version 26.08.0 or later as part of standard maintenance, though this is not an emergency remediation scenario.