CVE-2023-50914

2024-04-3000:00:00

mitre

www.cve.org

inter-process communication

gog galaxy

privilege escalation

authenticated users

dacl

arbitrary system directories

fixdirectoryprivileges

galaxyclient.exe

galaxyclientservice.exe

AI Score

6.9

Confidence

High

EPSS

Percentile

15.5%

JSON

A Privilege Escalation issue in the inter-process communication procedure from GOG Galaxy (Beta) 2.0.67.2 through v2.0.71.2 allows authentictaed users to change the DACL of arbitrary system directories to include Everyone full control permissions by modifying the FixDirectoryPrivileges instruction parameters sent from GalaxyClient.exe to GalaxyClientService.exe.