Description
An exploitable local privilege escalation vulnerability exists in GOG Galaxy 2.0.46. Due to insufficient folder permissions, an attacker can hijack the %ProgramData%\GOG.com folder structure and change the GalaxyCommunication service executable to a malicious file, resulting in code execution as SYSTEM.
Exploits (1)
References (4)
Scores
CVSS v3
7.8
EPSS
0.0098
EPSS Percentile
76.9%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-281
Status
published
Products (1)
gog/galaxy
2.0.46 - 2.0.51
Published
Aug 17, 2022
Tracked Since
Feb 18, 2026