The vulnerability CVE-2026-0539 arises from incorrect default permissions on the pcvisit service binary in the pcvisit Remote Host Modul for Windows. This misconfiguration permits a low-privileged local attacker to overwrite the service binary with arbitrary data. Since the service binary is launched with NT\SYSTEM privileges during system boot, this flaw enables privilege escalation to the highest system level. The vulnerability affects all versions after 22.6.22.1329 and has been addressed in version 25.12.3.1745. The CVSS 4.0 base score is 8.5, reflecting high impact due to ease of local attack and high confidentiality, integrity, and availability impacts. There is no vendor advisory or patch link provided in the data, and no known exploits in the wild have been reported.

A low-privileged local attacker can escalate privileges to NT\SYSTEM by overwriting the pcvisit service binary due to incorrect default permissions. This can lead to full system compromise with the highest privileges on affected Windows systems running vulnerable versions of pcvisit Remote Host Modul.

The vulnerability has been fixed in pcvisit Remote Host Modul version 25.12.3.1745. Users should upgrade to this or a later version to remediate the issue. Since no vendor advisory or patch link is provided, users must verify the patch availability and installation instructions from the official pcvisit vendor resources. Until patched, restricting local access to trusted users only is recommended to reduce risk.