CVE-2026-7006: Sublime Hq Pty Ltd Sublime Text 3

High severity, CVSS 7.3. EPSS: 0.1% chance of exploitation in the next 30 days.

Sublime Text for Windows through Build 4192 (Sublime Text 4) and Build 3207 (Sublime Text 3) contains a local privilege escalation vulnerability that allows unprivileged local attackers to execute arbitrary code with elevated privileges by abusing the update staging mechanism. Attackers can place a malicious DLL in the user-writable staging directory under %LOCALAPPDATA%, mark it read-only to bypass cleanup, and have the elevated installer copy it into the protected installation directory, causing the DLL to execute in the context of any higher-privileged user who subsequently launches the application.

Affected products

Published 2026-09-18. Last modified 2026-09-22.