Skip to content
OpenAdvisories
Medium · 6.8 Public exploit CVE-2026-9490 EUVD-2026-31648GHSA-7cww-6v7x-9gjw

Acer Care Center creates a Named Pipe with a weak Security Descriptor

Published May 25, 2026 · Updated May 26, 2026 · Assigned by Acer

Vendor: Acer Product: Care Center

Description

A security vulnerability has been identified in Acer Care Center where the ACCSvc service creates a Named Pipe with a weak Security Descriptor. This vulnerability allows an authenticated local user to connect and send a specially crafted message (message type 0x03) to the pipe, causing the service to crash with exit code 1067 (ERROR_PROCESS_ABORTED). To mitigate this potential local service disruption, Acer requires users to update the software to the latest version.

Affected products

VendorProductAffectedFixed
Acer Care Center 4.0 – ≤ 4.00.3058 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • ugvxb/CVE-2026-9490 ★ 0 · May 30, 2026

    The ACCSvc service creates a Named Pipe with a weak Security Descriptor that allows any authenticated user to connect and send messages. When a specially crafted message (message type 0x03) is sent t…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References