{"id":"CVE-2026-0191","kind":"vulnerability","aliases":["CVE-2026-0191"],"related":[],"title":"Acropora event code: logic error allows local privilege escalation","description":"In event_set_sub of acropora_event.c, there is a possible Logic error due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.","summary":"A logic error in the event_set_sub function of acropora_event.c can be exploited to escalate privileges on the local machine. The sources say an attacker needs execution privileges and that user interaction is needed for exploitation.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"acropora","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["acropora","infrastructure"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:17:20+00:00","first_seen_at":"2026-11-10T20:46:00+00:00","triaged_at":"2026-11-10T20:54:12+00:00","updated_at":"2026-11-10T20:54:12+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T20:54:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Acropora event code: logic error allows local privilege escalation","impact":"high","summary":"A logic error in the event_set_sub function of acropora_event.c can be exploited to escalate privileges on the local machine. The sources say an attacker needs execution privileges and that user interaction is needed for exploitation.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["acropora"],"confidence":0.4,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated privileges on the affected system","analyst_note":"Identify the vendor and affected versions of acropora_event.c and check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-0191 for fixed versions.","how_to_check":"unknown","plain_action":"","product_name":"acropora","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000647,"input_tokens":4510,"output_tokens":391,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-0191':12A,15A '-2026':11A,14A 'acropora':1A,16A,17B,29B,62C 'allow':6A 'attack':45B 'code':3A,77C 'could':79C 'cve':10A,13A 'due':70C 'error':5A,21B,69C,74C 'escal':9A,35B,83C 'event':2A,24B,58C 'event.c':30B,63C 'execut':47B,87C 'exploit':33B,56B,94C 'function':27B 'infrastructur':18B 'interact':52B,91C 'lead':80C 'local':7A,39B,82C 'logic':4A,20B,68C,73C 'machin':40B 'need':46B,54B,89C 'possibl':67C 'privileg':8A,36B,48B,85C,88C 'say':43B 'set':25B,59C 'sourc':42B 'sub':26B,60C 'user':51B,90C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["acropora"],"ptokens":["acropora"],"labels":["acropora","infrastructure","unknown","vendor"],"campaign_type":null,"search_a":"'-0191':12A,15A '-2026':11A,14A 'acropora':1A,16A 'allow':6A 'code':3A 'cve':10A,13A 'error':5A 'escal':9A 'event':2A 'local':7A 'logic':4A 'privileg':8A","search_b":"'acropora':17B,29B 'attack':45B 'error':21B 'escal':35B 'event':24B 'event.c':30B 'execut':47B 'exploit':33B,56B 'function':27B 'infrastructur':18B 'interact':52B 'local':39B 'logic':20B 'machin':40B 'need':46B,54B 'privileg':36B,48B 'say':43B 'set':25B 'sourc':42B 'sub':26B 'user':51B","search_c":"'acropora':62C 'code':77C 'could':79C 'due':70C 'error':69C,74C 'escal':83C 'event':58C 'event.c':63C 'execut':87C 'exploit':94C 'interact':91C 'lead':80C 'local':82C 'logic':68C,73C 'need':89C 'possibl':67C 'privileg':85C,88C 'set':59C 'sub':60C 'user':90C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:17:20+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-0191","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0191","severity":null,"published_at":"2026-11-10T20:17:20+00:00","modified_at":"2026-11-10T20:17:20+00:00","first_seen_at":"2026-11-10T20:46:00+00:00","fetched_at":"2026-11-10T20:46:00+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}