What is CVE-2026-0776?

CVE-2026-0776 is a high-severity vulnerability in Discord Client, classified under Uncontrolled Search Path Element. CVSS score: 7.3/10. Published 2026-01-23.

How severe is CVE-2026-0776?

High severity. CVSS v3 base score is 7.3 out of 10.

Is CVE-2026-0776 known to be exploited?

11 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Discord Client

CVE-2026-0776

Discord Client Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Discord Client. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the discord_rpc module. The product loads a file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-27057.

EPSS: 0.004 (28.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.3 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.

Affected products

Discord Client — versions 1.0.9196

Weakness classification (CWE)

CWE-427 — Uncontrolled Search Path Element

Public proof-of-concept exploits

References

zdi-disclosures@trendmicro.com (x_research-advisory)

Frequently asked questions

What is CVE-2026-0776?: CVE-2026-0776 is a high-severity vulnerability in Discord Client, classified under Uncontrolled Search Path Element. CVSS score: 7.3/10. Published 2026-01-23.
How severe is CVE-2026-0776?: High severity. CVSS v3 base score is 7.3 out of 10.
Is CVE-2026-0776 known to be exploited?: 11 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.