CVE-2020-36976: acer global registration service Unquoted Search Path or Element
Vulnerability summary
CVE-2020-36976 is a high (CVSS 8.5) Unquoted Search Path or Element vulnerability in acer global registration service. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 7.2% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 27-01-2026PublishedVulnerability first disclosed.
- 29-01-2026Last modifiedVulnerability information updated.
Description
Acer Global Registration Service 1.0.0.3 contains an unquoted service path vulnerability in its service configuration that allows local users to potentially execute arbitrary code. Attackers can exploit the unquoted path in C:\Program Files (x86)\Acer\Registration\ to inject malicious executables that would run with elevated LocalSystem privileges during service startup.
CVSS metrics
4 scores · 2 sources · 2 versions- NVDNIST8.5HighCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.18%
Chance of exploitation in the next 30 days
Percentile
7%
Versus all other CVEs
30-day change
+0.01 pp
From 0.17% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundGlobal Registration Service 1.0.0.3 - 'GREGsvc.exe' Unquoted Service Path
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Acer1 product
- global registration service1.0.0.3
1 vendor · 1 product