EIP-2026-117974

This exploit leverages an unquoted service path vulnerability in SugarSync 4.1.3 to achieve local privilege escalation (LPE) by planting a malicious executable in the service path, which is executed with SYSTEM privileges upon service restart or system reboot.