Reference page — cumulative record through Saturday, October 3, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-7006

CVE-2026-7006HIGH

Sublime Text 4192/3207 Local Privilege Escalation via Update Staging Mechanism

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   N   L   P   H   H   H    7.0   .0013    2.0     —

AFFECTED
  Product         Versions  Fixed
  Sublime Text 4  4192 –    —
  Sublime Text 3  3207 –    —

TIMELINE
  Apr 24  Reserved by VulnCheck
  Sep 18  Published (CNA: VulnCheck)
  Oct 1   EXPLOIT PUBLISHED — CVE-2026-7006 (Sublime HQ Pty Ltd Sublime Text 4). Public exploit reference added.

CWE-494 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Awaiting Analysis

Description

Sublime Text for Windows through Build 4192 (Sublime Text 4) and Build 3207 (Sublime Text 3) contains a local privilege escalation vulnerability that allows unprivileged local attackers to execute arbitrary code with elevated privileges by abusing the update staging mechanism. Attackers can place a malicious DLL in the user-writable staging directory under %LOCALAPPDATA%, mark it read-only to bypass cleanup, and have the elevated installer copy it into the protected installation directory, causing the DLL to execute in the context of any higher-privileged user who subsequently launches the application.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
April 24, 2026	Reserved	Reserved by VulnCheck
September 18, 2026	Published	Published (CNA: VulnCheck)
October 1, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-7006 (Sublime HQ Pty Ltd Sublime Text 4). Public exploit reference added.

Affected

Affected products and packages — 2 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Sublime HQ Pty Ltd	Sublime Text 4	—	4192	—
Sublime HQ Pty Ltd	Sublime Text 3	—	3207	—

Weaknesses

CWE-494

References (3)

https://gist.github.com/anthok/765b3ca0223fabee38f51d8f832e2175 [technical-description, exploit]
https://www.sublimetext.com/ [product]
https://www.vulncheck.com/advisories/sublime-text-4192-3207-local-privilege-escalation-via-update-staging-mechanism [third-party-advisory]

Authoritative record: CVE-2026-7006 at cve.org

Vendors: sublime hq pty

Weaknesses: CWE-494

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-7006 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Saturday, October 3, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.