Executive brief
ANSSI DFIR-ORC is a forensic tool used by security professionals to collect and analyze data from Windows systems during incident investigations. A vulnerability in how the tool handles temporary files allows a local attacker with low-level access to plant a malicious file that the tool will automatically run with administrative rights. This could allow an attacker to take full control of the machine, potentially compromising the integrity of a forensic investigation or gaining persistent access to a sensitive system.
Technical details
A local privilege escalation vulnerability exists in ANSSI DFIR-ORC versions 10.2.7 and prior due to an uncontrolled search path (CWE-427). The application extracts and executes components from shared temporary directories (such as C:\Windows\Temp) with administrative privileges. An attacker with prior local access can place a malicious DLL in this directory and wait for the application to be executed. Because the tool loads libraries from its execution directory, it will load the attacker's malicious DLL, resulting in code execution with the privileges of the user running DFIR-ORC (typically SYSTEM or Administrator). The issue is fully addressed in version 10.3.0, which introduces a minimal binary loader (OrcCapsule) and improved ACL checks.
Affected products
- ANSSI DFIR-ORC <= 10.2.7
Timeline
- 2026-04-17: patched: Version 10.3.0 released on GitHub
- 2026-06-18: disclosed: Vulnerability details published by INCIBE and NVD