CVE-2022-31262: gog galaxy Improper Preservation of Permissions

Vulnerability summary

CVE-2022-31262 is a high (CVSS 7.8) Improper Preservation of Permissions vulnerability in gog galaxy. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 42.7% of scored vulnerabilities. 4 public exploits are recorded.

Timeline

1. 17-08-2022
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

An exploitable local privilege escalation vulnerability exists in GOG Galaxy 2.0.46. Due to insufficient folder permissions, an attacker can hijack the %ProgramData%\GOG.com folder structure and change the GalaxyCommunication service executable to a malicious file, resulting in code execution as SYSTEM.

• CWE-281Improper Preservation of PermissionsThe product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.