CVE-2018-4048
HIGHGOG Galaxy - Exposure to Wrong Actor
Title source: ruleDescription
An exploitable local privilege elevation vulnerability exists in the file system permissions of the `Temp` directory in GOG Galaxy 1.2.48.36 (Windows 64-bit Installer). An attacker can overwrite executables of the Desktop Galaxy Updater to exploit this vulnerability and execute arbitrary code with SYSTEM privileges.
Scores
CVSS v3
7.8
EPSS
0.0005
EPSS Percentile
16.5%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Classification
CWE
CWE-668
Status
published
Affected Products (1)
gog/galaxy
Timeline
Published
May 30, 2019
Tracked Since
Feb 18, 2026