A vulnerability has been identified in Razer RzUpdateService version 1.10.14.0, specifically in the Named Pipe Handler component of RzUpdateService.exe. The flaw involves improper privilege management triggered by manipulation of the lpThreadParameter argument. The vulnerability requires local access to exploit, limiting remote attack surface, but a public exploit is already available. The issue was responsibly disclosed to the vendor prior to public release. If exploited, an attacker with local access could escalate privileges on the affected system. The vulnerability is tracked as CVE-2026-18606 and is considered high severity due to the availability of a working public exploit.