CVE-2026-1995 is an improper privilege management vulnerability (CWE-269) in IDrive Cloud Backup Client for Windows. The id_service.exe process runs with elevated SYSTEM privileges and reads UTF16-LE encoded files from C:\ProgramData\IDrive\. These files, writable by standard users, are used as arguments to start new processes. An attacker with standard user access can modify these files to specify an arbitrary executable path, causing id_service.exe to launch that executable with SYSTEM privileges, resulting in privilege escalation.

Successful exploitation allows a local attacker with standard user privileges to execute arbitrary code with SYSTEM-level privileges on the affected Windows system. This can lead to full system compromise, including confidentiality, integrity, and availability impacts.

No official patch or remediation information is provided in the vendor advisory links. Patch status is not yet confirmed — check the vendor advisory at https://kb.cert.org/vuls/id/330121 for current remediation guidance. Until a fix is available, restrict write permissions to the C:\ProgramData\IDrive\ directory to trusted administrators only to prevent unauthorized modification of the files used by id_service.exe.