high7.8
CVE-2022-31262
An exploitable local privilege escalation vulnerability exists in GOG Galaxy 2.0.46.
Impact
An exploitable local privilege escalation vulnerability exists in GOG Galaxy 2.0.46. Due to insufficient folder permissions, an attacker can hijack the %ProgramData%\GOG.com folder structure and change the GalaxyCommunication service executable to a malicious file, resulting in code execution as SYSTEM.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gog | Galaxy | from 2.0.46 through 2.0.51 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/secure-77/CVE-2022-31262
- https://secure77.de/category/subjects/researches/
- https://secure77.de/gog-galaxy-cve-2022-31262/
- https://www.youtube.com/watch?v=Bgdbx5TJShI
- https://github.com/secure-77/CVE-2022-31262
- https://secure77.de/category/subjects/researches/
- https://secure77.de/gog-galaxy-cve-2022-31262/
- https://www.youtube.com/watch?v=Bgdbx5TJShI