CVE WatchJul 24, 2026

CVE-2026-50100

Multiple printer drivers provided by Ricoh Company, Ltd. and KONICA MINOLTA JAPAN, INC. contain a privilege escalation vulnerability. If thi

CVSS

7.8

High

EPSS

0.1%

KEV

—

Exploit Today

0-100

Published: Jun 15, 2026 · Last modified: Jul 24, 2026 · CWE-427

EPSS · 30d

0.1%EPSS · 30 days0.1%

2026-08-042026-08-31

Technical description

Multiple printer drivers provided by Ricoh Company, Ltd. and KONICA MINOLTA JAPAN, INC. contain a privilege escalation vulnerability. If this vulnerability is exploited, an attacker who can log in to a computer running an affected printer driver could elevate privileges by using a specially crafted driver.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-452217.8 HIG

—

———Konga before 2.1.0 contains a privilege escalation vulnerability that allows low-privileged local attackers to execute arbitrary code by planting attacker-controlled OpenSSL configuration or library files in a hardcoded filesystem path absent from default installations. On Windows, the missing directory resides in a location writable by any authenticated local user, enabling attackers to create the directory and place malicious files that execute at the privilege level of the user or service account that launches Konga, facilitating privilege escalation.6h CVE-2026-19590—

—

———OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations trusted the repository's local core.hooksPath setting. If a user opens an attacker-prepared repository whose preserved .git/config points core.hooksPath to an attacker-controlled directory, Codex can run a malicious hook while processing the repository. The hook executes outside Codex's command sandbox, without user approval, and with the user's privileges, allowing it to read, change, or delete the user's files and access other resources available to the user's account. An ordinary Git clone does not preserve the attacker-controlled repository-local configuration required for exploitation.6h CVE-2026-82649—

2.2%

——1SiYuan Windows installer before version 3.8.1 (affected versions >= 2.0.14) contains an uncontrolled search path element vulnerability in its NSIS installer, which invokes system executables such as TASKKILL by name rather than by absolute path. Because NSIS nsExec::Exec resolves these calls using a search path that includes the installer's own launch directory ahead of System32, an attacker who plants a malicious executable (e.g., a renamed TASKKILL.exe) in that directory can have it executed when the installer runs. These calls occur in electron-builder's preInit hook before the license page is displayed, and with an all-users (elevated) install the planted binary executes with an elevated token, resulting in local privilege escalation.11h CVE-2026-650939.9 CRI

40.0%

——12NVIDIA OpenShell for Linux contains a vulnerability where an attacker could cause a sandbox escape. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.8h CVE-2026-550155.5 MED

40.3%

——12Uncontrolled search path element in Windows Remote Help allows an authorized attacker to deny service locally.11d CVE-2026-550137.1 HIG

13.2%

——4Uncontrolled search path element in Windows Remote Help Defense allows an authorized attacker to perform spoofing locally.11d