---------------------------------------------------------------------------- NotCVE Advisory — NotCVE-2026-0010 ----------------------------------------------------------------------------
[-] Summary: Barrier 2.4.0 for Windows contains a local privilege escalation vulnerability in the IPC command interface exposed by the barrierd.exe service on 127.0.0.1:24801. The IPC server accepts local TCP clients and processes a command line together with a one-byte elevation flag without authenticating the connecting process or verifying that it is authorised to request elevated process creation. A low-privileged local attacker can therefore execute arbitrary commands as NT AUTHORITY\SYSTEM, resulting in complete compromise of the affected host. CVSS:3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). [-] Affected: Barrier (Debauchee), version 2.4.0 for Windows. Earlier affected versions have not been established. Barrier is no longer maintained and no patched release has been verified. [-] Technical Description: The Barrier daemon (barrierd.exe) exposes an IPC server on the loopback interface at TCP port 24801. A client sends an IHEL client hello identifying itself as a supported IPC client type, followed by a kIpcCommand (ICMD) message containing a command line and a one-byte elevation flag. The reviewed IPC acceptance and command-processing paths do not authenticate the connecting process, verify its Windows identity, or authorise it to request elevated process creation. When the elevation flag is enabled, DaemonApp::handleIpcMessage() forwards the supplied command and elevation value to MSWindowsWatchdog. The watchdog locates winlogon.exe in the relevant Windows session, duplicates its privileged token, and supplies the attacker-controlled command line to CreateProcessAsUser. The command therefore executes as NT AUTHORITY\SYSTEM. Barrier additionally stores the last IPC-supplied values in the system settings as Command and Elevate. These values are loaded again when the daemon starts and passed back to the watchdog, so an attacker-supplied elevated command can execute again after service restarts or system reboots until the stored command is cleared. Weaknesses: CWE-306 (Missing Authentication for Critical Function), CWE-862 (Missing Authorization). Pattern: CAPEC-69 (Target Programs with Elevated Privileges). A proof of concept is published in the researcher's repository (see References). [-] Timeline: [25/07/2026] - NotCVE ID requested. [27/07/2026] - NotCVE ID reserved. [27/07/2026] - Published as NotCVE-2026-0010. [-] Credit: Discovered by Christopher Duram (https://www.linkedin.com/in/christopherduram/). [-] References: https://notcve.org/notcve/NotCVE-2026-0010 https://github.com/cduram/NotCVE-2026-0010 https://github.com/cduram/NotCVE-2026-0010/blob/main/Debauchee_Barrier_Privesc.py https://github.com/debauchee/barrier/releases/tag/v2.4.0 https://github.com/debauchee/barrier/blob/master/src/lib/ipc/Ipc.h https://github.com/debauchee/barrier/blob/master/src/lib/ipc/IpcServer.cpp https://github.com/debauchee/barrier/blob/master/src/lib/ipc/IpcClientProxy.cpp https://github.com/debauchee/barrier/blob/master/src/lib/barrier/win32/DaemonApp.cpp https://github.com/debauchee/barrier/blob/master/src/lib/platform/MSWindowsWatchdog.cpp [-] About NotCVE: NotCVE (https://notcve.org) assigns public, timestamped NotCVE IDs to vulnerabilities not acknowledged by vendors. Vendor will not assign a CVE? Request a NotCVE: https://notcve.org/form/ · Contributors: https://notcve.org/hall/
