CVE-2026-18606: High Privilege Escalation in Razer RzUpdateService

CVE-2026-18606 is a high severity (CVSS 7.8) local privilege escalation in Razer RzUpdateService 1.10.14.0, caused by improper privilege management in its named pipe handler. VulDB says the vendor was contacted early. We could not confirm a fix, so check Razer for an updated build.

What's affected

The record names Razer RzUpdateService 1.10.14.0 and the file RzUpdateService.exe in the RzUpdateEngineService folder under Program Files (x86)\Razer, in the Named Pipe Handler component. The attack needs local access with low privileges and no user interaction.

The record says an exploit has been made public, and that the vendor was contacted early. It does not say a fix exists. The VulDB pages could not be loaded when we fetched them, so we cannot name a fixed version. Check Razer's support pages for a current build of the software that installs this service.

No CPE data is attached to the record. KEV status is false.

How to check if you're exposed

On Windows, look for the service and its version. In an administrator PowerShell session:

Get-Service | Where-Object Name -like '*Rz*'

Then check the file version of RzUpdateService.exe in the installation folder from its Properties dialog and compare it with 1.10.14.0.

For a fleet, use your endpoint inventory to search for the Razer update components. Shared workstations and lab machines matter most, because the flaw is local and a low-privileged user is enough.

What to do now

1. Find hosts with RzUpdateService installed.
2. Check Razer's site and update the software to the newest build.
3. On machines where Razer software is not needed, uninstall it.
4. Limit who can log on interactively to shared or sensitive Windows machines.
5. Use endpoint detection to alert on unexpected child processes of the service.
6. Keep standard users from installing software that adds privileged services.

Why it matters

The weaknesses are CWE-266 (incorrect privilege assignment) and CWE-269 (improper privilege management). The service runs with high rights and exposes a named pipe, a local communication channel. When the pipe handler trusts what a less privileged client sends, that client can borrow the service's rights. The record points to the thread parameter in the handler as the affected argument.

Vendor update helpers and hardware utilities are common homes for this kind of flaw, because they install privileged services on many machines that nobody thinks of as servers. The fix is usually a vendor update, and the best defense when none exists is to remove software you do not need. We describe the weakness at the level the record does, without detail on how to use it.

Quick check

Sources

• VulDB entry 385529 (page did not load when fetched)
• Researcher write-up cited by the record

Last reviewed: 18 October 2026.