IDrive’s id_service.exe process runs with elevated privileges and regularly reads from several files under the C:\ProgramData\IDrive\ directory. The UTF16-LE encoded contents of these files are used as arguments for starting a process, but they can be edited by any standard user logged into the system. An attacker can overwrite or edit the files to specify a path to an arbitrary executable, which will then be executed by the id_service.exe process with SYSTEM privileges.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Tue, 24 Mar 2026 20:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Tue, 24 Mar 2026 18:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | IDrive’s id_service.exe process runs with elevated privileges and regularly reads from several files under the C:\ProgramData\IDrive\ directory. The UTF16-LE encoded contents of these files are used as arguments for starting a process, but they can be edited by any standard user logged into the system. An attacker can overwrite or edit the files to specify a path to an arbitrary executable, which will then be executed by the id_service.exe process with SYSTEM privileges. | |
| Title | IDrive Cloud Backup Client for Windows contains a privilege escalation vulnerability | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: certcc
Published:
Updated: 2026-03-24T19:24:11.136Z
Reserved: 2026-02-05T16:44:28.604Z
Link: CVE-2026-1995
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-03-24T19:16:49.033
Modified: 2026-03-24T20:16:25.990
Link: CVE-2026-1995
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
No weakness.