CVE-2022-40126

A misconfiguration in the Service Mode profile directory of Clash for Windows v0.19.9 allows attackers to escalate privileges and execute arbitrary commands when Service Mode is activated.

CVSS v3.1 NVD

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.32% chance of exploitation in the next 30 days, 23rd percentile

Published

2022-09-29

Updated

2025-05-21

Proof-of-concept exploits (1)

• LovelyWei/CVE-2022-401264★ · 2022-09-29

Security advisories

• Fndroid/clash_for_windows_pkg/issues/3405

References

• CVE Record
• NVD entry