wtf is cve-2026-49176_lpe_poc?

This repository is a proof of concept for a specific Windows security bug, tracked as CVE-2026-49176, which Microsoft already fixed in a July 2026 update. It demonstrates how a regular, non-administrator user on an affected Windows 11 machine could gain full system-level control, the highest level of access on the computer, by exploiting a flaw in a background component called WalletService. The technique works because WalletService looks up the location of the user's Documents folder while briefly acting as that user, but then switches to running with full system permissions before it opens a specific database file inside that folder. A regular user can point their own Documents folder somewhere they control, place a specially prepared database file there, and have that file contain a reference to a piece of code the user supplies. When WalletService opens the file while running with full permissions, it ends up loading and running that user-supplied code with the highest level of access instead of the user's own limited access. To run the demonstration on a still-vulnerable, unpatched Windows 11 system, a user opens a regular, non-administrator PowerShell window and runs a provided script, or simply double-clicks a batch file. If the machine is vulnerable, a new command prompt opens showing full system-level access. The repository also includes a build script for rebuilding the included program files using Microsoft's Visual Studio build tools, and a separate written technical explanation is linked for readers who want the full details of how the bug was found and works. This project is intended for security researchers and IT professionals who want to understand or verify the vulnerability, for example to confirm a system has been patched. It only affects systems that have not yet installed the July 2026 security update, and the README does not mention a license.