The vulnerability CVE-2026-26422 affects clash-verge-service-ipc versions before 2.3.0 by exposing an inter-process communication (IPC) endpoint with world-reachable permissions. This incorrect permission assignment (CWE-732) permits local attackers without privileges to escalate their privileges by interacting with this IPC endpoint. The CVSS 3.1 vector indicates the attack requires local access with low complexity and no privileges initially, leading to high impact on confidentiality, integrity, and availability. The vendor has not provided an official fix or advisory, and no patch links are available. The product is not a cloud service, so remediation depends on vendor updates or configuration changes.

Successful exploitation allows a local attacker to escalate privileges on the affected system, potentially gaining unauthorized access to sensitive information, modifying system integrity, and disrupting availability. The high CVSS score reflects the critical nature of the permission misconfiguration and the broad impact on system security. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users only and consider applying manual permission restrictions on the IPC endpoint if feasible. Monitor vendor communications for updates regarding patches or configuration recommendations.