EIP-2026-117272

This writeup describes an elevation of privilege (EoP) vulnerability in Hide.Me VPN Client 1.2.4 due to insecure default permissions on the installation directory, allowing a local user to replace binaries or DLLs to escalate to SYSTEM privileges.