KDE Kleopatra before 26.08.0 on Windows contains a flaw in the KUniqueService component that does not correctly enforce the intended single‑instance rule. This error allows a local user to gain the privileges of the Kleopatra user, effectively escalating their privileges within the local environment. The vulnerability is aligned with CWE‑670 and provides attackers with the ability to perform actions as the Kleopatra user, potentially expanding the attack surface for local privileges.

The affected vendor is KDE, product Kleopatra. All releases prior to version 26.08.0 on Windows are impacted. No Windows‑specific sub‑versions or alternate operating systems were listed in the advisory.

The CVSS score of 6.9 indicates a medium severity risk, and the EPSS score is not available, making the precise exploitation probability unclear. The vulnerability is not listed in CISA's KEV catalog. Attackers need local user access on a Windows system; no remote or network‑based attack vector is described. The risk manifests as local privilege escalation, allowing a malicious local user to execute Kleopatra processes with elevated rights.