CVE-2026-40032 is an OS command injection vulnerability in tclahr's UAC product before version 3.3.0-rc1. The vulnerability arises because the _run_command() function constructs command strings that are passed directly to eval without proper input sanitization. Attackers can exploit this by injecting malicious shell commands through placeholders like %line% from foreach iterators and %user% or %user_home% derived from system files, resulting in arbitrary command execution with the privileges of the UAC process.

Successful exploitation allows an attacker to execute arbitrary OS commands with the privileges of the UAC process. This can lead to unauthorized system access, data compromise, or further system manipulation depending on the privileges of the UAC process. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid running vulnerable versions of UAC or restrict inputs that can be passed to the _run_command() function. Monitoring for updates from the vendor is recommended.