CVE-2026-9490 - Acer Care Center creates a Named Pipe with a weak Security Descriptor · CoreCVE

Back Back to CVE browser

MEDIUM

Acer Care Center creates a Named Pipe with a weak Security Descriptor

Published May 25, 2026

6.8

MEDIUM

CVSS 4.0

EPSS 0.12%

Description

A security vulnerability has been identified in Acer Care Center where the ACCSvc service creates a Named Pipe with a weak Security Descriptor. This vulnerability allows an authenticated local user to connect and send a specially crafted message (message type 0x03) to the pipe, causing the service to crash with exit code 1067 (ERROR_PROCESS_ABORTED). To mitigate this potential local service disruption, Acer requires users to update the software to the latest version.

Affected products

Vendor Acer Product Care Center Default
unaffected
- Version
  4.0
  Status
  affected
  Constraints
  <=4.00.3058

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

unaffected

Version	Status	Constraints
4.0	affected	<=4.00.3058

Remediation

Vendor solution

Please update to v4.00.3060.

Weaknesses (1)

CWE-269

Improper Privilege Management

References (1)

https://community.acer.com/en/kb/articles/19668
Vendor Advisory

Link	Providers	Tags
https://community.acer.com/en/kb/articles/19668		Vendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Acer

Published May 25, 2026

Updated May 26, 2026

Reserved May 25, 2026

Link CVE-2026-9490

CISA Vulnrichment

Updated May 26, 2026

Status Analyzed

Modified Jul 23, 2026

Link CVE-2026-9490

Severity n/a

Public date n/a

Links CVE-2026-9490