CVE-2026-19191 is a permission-related vulnerability affecting StableBit DrivePool 2.3.13.1687, specifically in the DrivePoolService executable (DrivePool.Service.exe). The vulnerability arises from improper permission handling (CWE-266), allowing a local attacker with limited privileges to potentially gain elevated access or cause high impact on confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 base score of 7.8 (high), with attack vector local, low attack complexity, low privileges required, no user interaction, and impacts rated high for confidentiality, integrity, and availability. The exploit has been publicly disclosed, but no active exploitation is known. No patch or official fix details are available.

Successful exploitation can lead to significant permission issues, potentially allowing an attacker with local access to compromise confidentiality, integrity, and availability of the affected system. The vulnerability impacts core service functionality, which could result in unauthorized access or disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, users should monitor vendor communications for updates. Restrict local access to trusted users only as a precaution until a fix is available.