CVE-2026-0776

HIGH

Discord Client - Privilege Escalation

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 12 public exploits for CVE-2026-0776. PoCs published by whenx, whoanx, AnhedonicX.

AI-analyzed exploit summary This PoC exploits CVE-2026-0776, an uncontrolled search path element vulnerability in Discord Desktop Client (v1.0.9196) on Windows. It demonstrates how an attacker can achieve local code execution by placing a malicious Node.js module in a predictable location (C:\node_modules) that Discord loads during startup.

Description

Discord Client Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Discord Client. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the discord_rpc module. The product loads a file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-27057.

Exploits (12)

github WORKING POC 8 stars
by whenx · pythonpoc
https://github.com/whenx/CVE-2026-0776

This PoC exploits CVE-2026-0776, an uncontrolled search path element vulnerability in Discord Desktop Client (v1.0.9196) on Windows. It demonstrates how an attacker can achieve local code execution by placing a malicious Node.js module in a predictable location (C:\node_modules) that Discord loads during startup.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Discord Desktop Client 1.0.9196 (Windows)
No auth needed
Prerequisites: Local access to the target system · Ability to write to C:\ (or adjust the destination path) · Discord installed in default location
mistral-large-3 · analyzed Jul 21, 2026 Full analysis →
github WORKING POC 8 stars
by whoanx · pythonpoc
https://github.com/whoanx/CVE-2026-0776

This PoC exploits CVE-2026-0776, an uncontrolled search path element vulnerability in Discord Desktop Client (v1.0.9196) on Windows. It demonstrates local code execution by placing a malicious Node.js module in a predictable location (C:\node_modules) that Discord loads during startup, executing arbitrary JavaScript within the Discord process context.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Discord Desktop Client version 1.0.9196
No auth needed
Prerequisites: Local access to the target Windows system · Ability to write to C:\ (or modify the PoC to use another writable location) · Discord Desktop Client installed in default location
mistral-large-3 · analyzed Jul 19, 2026 Full analysis →
nomisec WORKING POC 8 stars
by AnhedonicX · poc
https://github.com/AnhedonicX/CVE-2026-0776

This PoC exploits CVE-2026-0776, an uncontrolled search path element vulnerability in Discord Desktop Client (v1.0.9196) on Windows. It demonstrates how an attacker can achieve local code execution by placing a malicious Node.js module in a predictable location (C:\node_modules) that Discord loads during startup.

Classification
Working Poc 98%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Discord Desktop Client version 1.0.9196
No auth needed
Prerequisites: Local access to the target Windows system · Ability to write to C:\ or another directory in Discord's module search path · Discord must be installed in the default location
mistral-large-3 · analyzed Jul 13, 2026 Full analysis →
github WORKING POC 5 stars
by zerkl · pythonpoc
https://github.com/zerkl/CVE-2026-0776

This PoC exploits CVE-2026-0776, an uncontrolled search path element vulnerability in Discord Desktop Client (v1.0.9196) on Windows. It demonstrates local code execution by placing a malicious Node.js module in a predictable location (C:\node_modules) that Discord loads during startup, executing arbitrary JavaScript within the Discord process context.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Discord Desktop Client version 1.0.9196
No auth needed
Prerequisites: Local access to the target Windows system · Ability to write to C:\ (or modify the PoC to use another writable location) · Discord installed in the default location
mistral-large-3 · analyzed Jul 09, 2026 Full analysis →
github WORKING POC 5 stars
by bufferoverfIow · pythonpoc
https://github.com/bufferoverfIow/CVE-2026-0776

This PoC exploits CVE-2026-0776, an uncontrolled search path element vulnerability in Discord Desktop Client (v1.0.9196) on Windows. It demonstrates how an attacker can achieve local code execution by placing a malicious Node.js module in a predictable location (C:\node_modules) that Discord loads during startup.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Discord Desktop Client version 1.0.9196
No auth needed
Prerequisites: Local access to the target Windows system · Ability to write to C:\ (or adjust the destination path) · Discord installed in the default location
mistral-large-3 · analyzed Jul 08, 2026 Full analysis →
nomisec WORKING POC 5 stars
by xsuf · poc
https://github.com/xsuf/CVE-2026-0776

This PoC exploits CVE-2026-0776, an uncontrolled search path element vulnerability in Discord Desktop Client (v1.0.9196) on Windows. It demonstrates how an attacker can achieve local code execution by placing a malicious Node.js module in a predictable location (C:\node_modules) that Discord loads during startup.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Discord Desktop Client version 1.0.9196
No auth needed
Prerequisites: Local access to the target Windows system · Ability to write to C:\ (or modify the PoC to use another writable location) · Discord installed in the default location
mistral-large-3 · analyzed Jul 07, 2026 Full analysis →
github WORKING POC 5 stars
by 0x8EF · pythonpoc
https://github.com/0x8EF/CVE-2026-0776

This PoC exploits CVE-2026-0776, an uncontrolled search path element vulnerability in Discord Desktop Client (v1.0.9196) on Windows. It demonstrates how an attacker can achieve local code execution by placing a malicious Node.js module in a predictable location (C:\node_modules) that Discord loads during startup.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Discord Desktop Client version 1.0.9196
No auth needed
Prerequisites: Local access to the target machine · Ability to write to C:\node_modules or another searched path · Discord Desktop Client installed on the target system
mistral-large-3 · analyzed Jul 06, 2026 Full analysis →
nomisec WORKING POC 5 stars
by paIantir · poc
https://github.com/paIantir/CVE-2026-0776

This PoC exploits an uncontrolled search path element (CWE-427) in Discord Desktop Client for Windows by placing a malicious Node.js module in a predictable location (C:\node_modules). When Discord launches, it loads the module, executing arbitrary JavaScript code with the privileges of the current user.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Discord Desktop Client version 1.0.9196
No auth needed
Prerequisites: Local access to the target Windows system · Ability to write to C:\ (or modify the PoC to use another writable directory) · Discord must be installed in the default location
mistral-large-3 · analyzed Jul 06, 2026 Full analysis →
nomisec WORKING POC 5 stars
by autopsyx · poc
https://github.com/autopsyx/CVE-2026-0776

This PoC exploits CVE-2026-0776, an uncontrolled search path element vulnerability in Discord Desktop Client (v1.0.9196) on Windows. It demonstrates how an attacker can achieve local code execution by placing a malicious Node.js module in a predictable location (C:\node_modules) that Discord loads during startup.

Classification
Working Poc 98%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Discord Desktop Client version 1.0.9196
No auth needed
Prerequisites: Local access to the target machine · Ability to write to C:\ (or modify the PoC to use another writable location) · Discord installed in the default location
mistral-large-3 · analyzed Jul 05, 2026 Full analysis →
nomisec WORKING POC 5 stars
by suffercurse · poc
https://github.com/suffercurse/CVE-2026-0776

This PoC exploits CVE-2026-0776, an uncontrolled search path element vulnerability in Discord Desktop Client (v1.0.9196) on Windows. It demonstrates local code execution by placing a malicious Node.js module in a predictable location (C:\node_modules) that Discord loads during startup, executing arbitrary JavaScript within the Discord process context.

Classification
Working Poc 98%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Discord Desktop Client 1.0.9196 (Windows)
No auth needed
Prerequisites: Local access to the target Windows system · Ability to write to C:\ (or modify the PoC to use another writable location) · Discord installed in the default location
mistral-large-3 · analyzed Jul 05, 2026 Full analysis →
github WORKING POC 2 stars
by 0x18F · pythonpoc
https://github.com/0x18F/CVE-2026-0776

This repository contains a functional PoC for CVE-2026-0776, demonstrating an uncontrolled search path element vulnerability in Discord's Node.js module resolution. The exploit deploys a malicious 'utf-8-validate.js' module to a predictable path, which Discord loads and executes when launched.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Discord Desktop Client 1.0.9196
No auth needed
Prerequisites: Local file system access · Ability to write to C:\node_modules · Discord installed and running on Windows
mistral-large-3 · analyzed Jun 10, 2026 Full analysis →
nomisec STUB
by OverlayCS · poc
https://github.com/OverlayCS/Helix

The repository contains a README with a vague description of CVE-2026-0776, claiming it exploits a Discord feature to open a command prompt as admin. No technical details, exploit code, or proof-of-concept implementation are provided.

Classification
Stub 95%
Attack Type
Other
Complexity
Unknown
Reliability
Theoretical
Target: Discord (unspecified version)
No auth needed
Prerequisites: Unclear due to lack of details; likely requires user interaction or specific Discord configuration
mistral-large-3 · analyzed Jul 07, 2026 Full analysis →

References (1)

Core 1
Core References
Third Party Advisory x_research-advisory
https://www.zerodayinitiative.com/advisories/ZDI-26-040/

Scores

CVSS v3 7.3
EPSS 0.0036
EPSS Percentile 28.7%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-427
Status published
Published Jan 23, 2026
Tracked Since Feb 18, 2026