CVE-2026-55567

Executive Summary

CVE-2026-55567 is a time-of-check time-of-use (TOCTOU) race condition (CWE-367) in BleachBit versions prior to 6.0.1 that affects privileged Windows cleaning operations. A local unprivileged user can exploit this flaw by replacing a target's parent directory with a Windows junction and using a native symlink to redirect an elevated file deletion to an attacker-selected file, ultimately enabling escalation to local SYSTEM privileges. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) and affects endpoints where BleachBit runs with elevated privileges on Windows.

Technical Analysis

BleachBit is a file-cleaning utility that removes files to free disk space and maintain privacy. On Windows, certain cleaning operations run with elevated privileges. The vulnerability resides in the privileged cleaning workflow: prior to version 6.0.1, the software does not lock and validate a target's parent directory before performing a deletion.

This is a classic time-of-check time-of-use (TOCTOU) condition, classified as CWE-367. The privileged process identifies a directory (the "target's parent directory"), then performs a deletion against a file within it. Because the parent directory is not locked with a handle that prevents reparse-point substitution, and because the directory is not re-validated immediately before deletion, a local unprivileged user has a window in which to swap that directory for a different filesystem object.

On Windows, two relevant reparse-point mechanisms are involved:

• Windows junctions (directory reparse points): A local user can replace the validated parent directory with a junction that points to a different location.
• Native symlinks (file system reparse points): Combined with the junction, a symlink can be used to redirect the elevated deletion so that it resolves to an attacker-selected file.

The result is arbitrary privileged file deletion: the elevated BleachBit process deletes a file of the attacker's choosing rather than the intended cleaning target. Because the deletion is performed with elevated rights, the attacker can remove files that their unprivileged context normally could not touch.

The NVD description states that this arbitrary privileged file deletion can be combined with Windows Installer behavior to obtain local SYSTEM privileges. The specific Windows Installer technique is not detailed in the available data; it is a well-known class of privilege-escalation primitive in which an attacker manipulates a privileged file operation to influence subsequent Windows Installer repair or rollback behavior. No further implementation specifics are provided by the advisory.

Root cause summary: absence of parent-directory locking and absence of re-validation of the target path after the check and before the delete, allowing reparse-point redirection of an elevated delete operation.

Exploitation Scenarios

No public proof-of-concept is available for CVE-2026-55567 as of this report. The attack chain below is described at the vulnerability-class level strictly from the NVD description; no specific function names, paths, or parameters are asserted beyond what the advisory provides.

1. Reconnaissance / target identification. The attacker must already hold a local unprivileged account on a Windows host where an elevated BleachBit cleaning operation is scheduled or can be initiated. The attacker identifies a cleaning target whose parent directory is writable or manipulable by the unprivileged account, and determines when the privileged cleaning operation runs.

2. Triggering the TOCTOU condition. The attacker replaces the target's parent directory with a Windows junction. Because BleachBit (before 6.0.1) does not lock and validate the parent directory before deletion, the elevated process continues to operate on what it believes is the original directory but is now a reparse point under attacker control.

3. Redirecting the elevated deletion. Using a native symlink in conjunction with the junction, the attacker causes the elevated deletion to resolve to an attacker-selected file. When BleachBit performs the privileged delete, it removes that chosen file rather than the intended cleaning target. This yields arbitrary privileged file deletion.

4. Post-exploitation / privilege escalation. The advisory states this arbitrary privileged file deletion can be combined with Windows Installer behavior to obtain local SYSTEM privileges. The attacker engineers the deleted file so that a subsequent Windows Installer operation repairs or restores it in a way that gives the attacker control over a privileged resource, resulting in SYSTEM-level code execution. The precise Windows Installer interaction is not specified in the available data.

Reliability depends on winning the race window between the parent-directory check and the delete. The CVSS vector (AV:L/AC:L/PR:L/UI:N) indicates a local attack with low complexity, low privileges required, and no user interaction, meaning exploitation does not depend on tricking a victim.

Impact Assessment

The CVSS v3.1 base score is 7.8 (High), with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

• Attack Vector (L): Requires local access to the target host.
• Attack Complexity (L): No specialized conditions beyond the race window; the advisory implies a straightforward chain.
• Privileges Required (L): Only an unprivileged local account is needed.
• User Interaction (N): No victim interaction required.
• Scope (U): Impact is confined to the same security authority.
• Confidentiality / Integrity / Availability (H/H/H): Full high impact across all three, consistent with arbitrary privileged file deletion escalating to local SYSTEM.

Business impact: On any Windows endpoint where BleachBit runs elevated (common on administrative workstations, shared hosts, and jump boxes where privacy/cleanup tooling is deployed), an unprivileged local user can escalate to SYSTEM. SYSTEM compromise typically means full control of the host, potential credential theft, disabling of security controls, and lateral movement. Blast radius is limited to hosts running the affected BleachBit version with privileged cleaning enabled; it is not a remote or network-exploitable issue. EPSS has not yet been scored by FIRST.org, and there is no evidence of CISA KEV listing or in-the-wild exploitation.

Detection Guidance

Because the exploit relies on filesystem reparse-point manipulation (junctions and symlinks) and elevated deletion events, detection should focus on creation of junctions/symlinks in cleanup-target directories and on privileged file deletion anomalies.

Sigma Rule

title: Potential BleachBit TOCTOU Privilege Escalation via Junction/Symlink Creation
id: 5c8f2b1a-9d4e-4a7c-b2f0-7e1a3c6d9f21
status: experimental
description: Detects creation of directory junctions or symbolic links shortly before an elevated BleachBit cleaning operation, consistent with CVE-2026-55567 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-55567
author: Threat Intelligence
date: 2026/01/01
logsource:
  product: windows
  category: process_creation
detection:
  selection_tool:
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\pwsh.exe'
  selection_cmd:
    CommandLine|contains:
      - 'mklink /J'
      - 'mklink /D'
      - 'mklink /H'
      - 'New-Item -ItemType Junction'
      - 'New-Item -ItemType SymbolicLink'
  selection_target:
    CommandLine|contains:
      - 'BleachBit'
      - 'bleachbit'
  condition: selection_tool and selection_cmd and selection_target
fields:
  - CommandLine
  - ParentImage
  - User
falsepositives:
  - Legitimate administrative use of mklink targeting cleanup directories
level: high

YARA Rule

rule CVE_2026_55567_BleachBit_TOCTOU
{
    meta:
        description = "Detects references to BleachBit privileged cleaning and reparse-point (junction/symlink) redirection associated with CVE-2026-55567"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-55567"
        cve = "CVE-2026-55567"

    strings:
        $bb1 = "BleachBit" ascii nocase wide
        $bb2 = "bleachbit" ascii nocase
        $j1  = "mklink /J" ascii nocase wide
        $j2  = "mklink /D" ascii nocase wide
        $sy1 = "New-Item -ItemType Junction" ascii nocase wide
        $sy2 = "New-Item -ItemType SymbolicLink" ascii nocase wide

    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x464C457F) and
        any of ($bb*) and any of ($j*, $sy*)
}

Suricata IDS Rule

alert smb any any -> any any (msg:"CVE-2026-55567 Potential BleachBit TOCTOU Junction/Symlink Manipulation Over SMB"; flow:to_server,established; content:"BleachBit"; nocase; content:"junction"; nocase; distance:0; content:"symlink"; nocase; distance:0; classtype:attempted-privileges; reference:cve,2026-55567; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-55567; sid:2026555670; rev:1;)

Elastic Detection

process where host.os.type == "windows" and event.type == "start" and
  process.parent.name : ("cmd.exe", "powershell.exe", "pwsh.exe") and
  process.command_line : ("*mklink*" or "*New-Item*Junction*" or "*New-Item*SymbolicLink*") and
  process.command_line : ("*BleachBit*" or "*bleachbit*")

Splunk SPL Query

index=windows (source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1)
| search (CommandLine="*mklink*" OR CommandLine="*New-Item*Junction*" OR CommandLine="*New-Item*SymbolicLink*")
| search (CommandLine="*BleachBit*" OR CommandLine="*bleachbit*")
| table _time, host, user, ParentImage, Image, CommandLine
| sort - _time

Wazuh OSSEC Rule

<group name="windows,sysmon,privilege_escalation,">
  <rule id="202555670" level="12">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.commandLine">mklink|New-Item.*(Junction|SymbolicLink)</field>
    <field name="win.eventdata.commandLine">BleachBit|bleachbit</field>
    <description>CVE-2026-55567: Possible BleachBit TOCTOU exploitation via junction/symlink creation</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Upgrade BleachBit to version 6.0.1 or later, which the advisory states fixes the issue. Although no patch evidence is tracked in this dataset (confidence 0/4), version 6.0.1 is the version the advisory identifies as fixed; verify availability directly from the vendor.
   • Until upgrade is feasible, restrict or eliminate privileged (elevated) Windows cleaning operations on hosts accessible to unprivileged local users.
   • Remove local unprivileged access or isolate hosts where BleachBit must run elevated.
   • Monitor for creation of Windows junctions and native symlinks in directories that are targets of elevated cleaning.

2. Patch/upgrade steps

   • Confirm the installed BleachBit version; affected versions are those prior to 6.0.1.
   • Obtain the 6.0.1 release from the official BleachBit distribution channel and upgrade.
   • Re-verify after upgrade that privileged cleaning no longer follows reparse points, if test capability exists.

3. Long-term hardening

   • Apply the principle of least privilege: do not run cleanup/utility tooling as SYSTEM or elevated unless strictly required.
   • Enforce filesystem hardening that limits unprivileged users' ability to create reparse points (junctions/symlinks) in sensitive directories.
   • Implement monitoring and alerting on elevated delete operations and on reparse-point creation (see Detection Guidance).
   • Track the vendor advisory and CVE record for a formal patched release and re-evaluate patch confidence when a fix source becomes available.

References

• NVD — CVE-2026-55567: https://nvd.nist.gov/vuln/detail/CVE-2026-55567
• BleachBit project site (vendor; consult for the 6.0.1 release): https://www.bleachbit.org/
• CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition: https://cwe.mitre.org/data/definitions/367.html
• MITRE ATT&CK T1068 — Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-55567 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence were identified in the available data. EPSS has not yet been scored by FIRST.org, and no public PoC or exploit code is available.