davidcarliez/cve-2026-58635-poc

This repository is a proof of concept for CVE-2026-58635, a security flaw in the Windows Narrator Braille feature. It demonstrates how a regular, already logged in user on a Windows machine could trick a background service called BRLTTY into running a program with much higher permissions than that user actually has. Microsoft rates the issue as Important, with a numerical severity score of 7.8 out of 10. The flaw works because a setting inside BRLTTY, meant to point to a braille translation table, is not checked carefully enough. A standard user can set that value to point at their own program instead, and the service will run it under a privileged system account. From there, an included helper tool can escalate that access further, up to full SYSTEM level control, which is the highest level of access on a Windows machine. This only affects machines that have installed the optional Windows accessibility feature for Braille support. The repository includes a script that safely checks whether a given machine has that feature installed and whether it has already been patched, without actually running the exploit. It also lists the exact Windows build numbers where Microsoft's July 2026 update fixes the problem. The project is written in C++ and built using the MinGW-w64 compiler, producing small Windows programs. It comes with detailed setup scripts meant only for an isolated test lab: preparing the vulnerable feature, running the demonstration as a standard user, and clearing the generated result files afterward. The author is explicit that this is for authorized security testing only, not for use on machines you do not own or manage, and recommends applying the vendor's patch as the real fix. This is aimed at security researchers and IT administrators who need to confirm whether their systems are exposed and verify that a patch closes the gap.