A high-severity local privilege escalation vulnerability in BleachBit allows unprivileged users to escalate to SYSTEM privileges via a race condition during privileged file cleaning operations.

This vulnerability is a Time-of-Check Time-of-Use (TOCTOU) race condition (CWE-367) where the application fails to validate the target directory before deletion. An unprivileged local attacker can manipulate the directory structure with symlinks to force the application to delete arbitrary files with elevated privileges, leading to full system compromise.

The ability for a local user to gain SYSTEM-level access poses a critical risk to the confidentiality, integrity, and availability of the host machine. Successful exploitation allows an attacker to bypass all operating system security controls, potentially leading to total system takeover, installation of persistent backdoors, and full data exfiltration. The CVSS score of 7.8 reflects the high impact on local security boundaries, despite the requirement for local access.

Immediate Action: Update BleachBit to version 6.0.1 or later immediately to incorporate the necessary directory validation logic.

Proactive Monitoring: Monitor system logs for unusual file access patterns or unexpected attempts to create junctions and symbolic links in system-protected directories.

Compensating Controls: Restrict local user permissions where possible and audit the use of applications that require elevated privileges for routine maintenance tasks.

Public Exploit Available: No (exploit_available unknown)

This vulnerability represents a significant security risk for any environment where BleachBit is utilized with administrative privileges. Because the flaw allows an unprivileged user to obtain full control over the underlying Windows operating system, patching is mandatory. Organizations should prioritize upgrading to version 6.0.1 across all affected endpoints to eliminate the underlying race condition.