{"id":"CVE-2020-24574","aliases":["EUVD-2020-17293","GHSA-p249-vr5g-ff3h"],"status":"published","title":"The client (aka GalaxyClientService.exe) in GOG GALAXY 2.0.19 allows local privilege escalation...","description":"The client (aka GalaxyClientService.exe) in GOG GALAXY through 2.0.41 (as of 12:58 AM Eastern, 9/26/21) allows local privilege escalation from any authenticated user to SYSTEM by instructing the Windows service to execute arbitrary commands. This occurs because the attacker can inject a DLL into GalaxyClient.exe, defeating the TCP-based \"trusted client\" protection mechanism.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00623,"percentile":0.50239,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-269","CWE-798"],"published":"2020-08-21T03:41:50Z","modified":"2026-06-17T03:05:47Z","products":[{"vendor":"gog","product":"galaxy"}],"references":[{"url":"https://www.gog.com/galaxy","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://www.positronsecurity.com/blog/2020-08-13-gog-galaxy_client-local-privilege-escalation_deuce/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://github.com/jtesta/gog_galaxy_client_service_poc","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://github.com/jtesta/gog_galaxy_client_service_poc/issues/1#issuecomment-926932218","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-24574"},{"url":"https://github.com/advisories/GHSA-p249-vr5g-ff3h"}],"sources":{"cve":[{"id":"CVE-2020-24574","description":"The client (aka GalaxyClientService.exe) in GOG GALAXY through 2.0.41 (as of 12:58 AM Eastern, 9/26/21) allows local privilege escalation from any authenticated user to SYSTEM by instructing the Windows service to execute arbitrary commands. This occurs because the attacker can inject a DLL into GalaxyClient.exe, defeating the TCP-based \"trusted client\" protection mechanism.","status":"published","published":"2020-08-21T03:41:50Z","modified":"2024-08-04T15:19:09.112Z","updated_at":"2026-11-02T14:35:54.468882Z"}],"euvd":[{"id":"EUVD-2020-17293","description":"The client (aka GalaxyClientService.exe) in GOG GALAXY through 2.0.41 (as of 12:58 AM Eastern, 9/26/21) allows local privilege escalation from any authenticated user to SYSTEM by instructing the Windows service to execute arbitrary commands. This occurs because the attacker can inject a DLL into GalaxyClient.exe, defeating the TCP-based \"trusted client\" protection mechanism.","status":"published","published":"2020-08-21T03:41:50Z","modified":"2024-08-04T15:19:09Z","updated_at":"2026-11-03T03:07:19.775117Z"}],"ghsa":[{"id":"GHSA-p249-vr5g-ff3h","title":"The client (aka GalaxyClientService.exe) in GOG GALAXY 2.0.19 allows local privilege escalation...","description":"The client (aka GalaxyClientService.exe) in GOG GALAXY 2.0.19 allows local privilege escalation from any authenticated user to SYSTEM by instructing the Windows service to execute arbitrary commands. This occurs because the attacker can inject a DLL into GalaxyClient.exe, defeating the TCP-based \"trusted client\" protection mechanism.","status":"published","published":"2022-05-24T17:26:20Z","modified":"2023-01-29T05:03:50Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269","CWE-798"],"updated_at":"2026-11-02T14:45:24.688971Z"}],"nvd":[{"id":"CVE-2020-24574","description":"The client (aka GalaxyClientService.exe) in GOG GALAXY through 2.0.41 (as of 12:58 AM Eastern, 9/26/21) allows local privilege escalation from any authenticated user to SYSTEM by instructing the Windows service to execute arbitrary commands. This occurs because the attacker can inject a DLL into GalaxyClient.exe, defeating the TCP-based \"trusted client\" protection mechanism.","status":"published","published":"2020-08-21T04:15:10.787Z","modified":"2026-06-17T03:05:47.293Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.9,"vector":"AV:L/AC:M/Au:N/C:C/I:C/A:C","level":"medium","assessor":"primary"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T14:06:13.05572Z"}]}}