{"id":"CVE-2022-31262","aliases":["EUVD-2022-52838","GHSA-mwfm-4frv-j42h"],"status":"published","title":"An exploitable local privilege escalation vulnerability exists in GOG Galaxy 2.0.46. Due to...","description":"An exploitable local privilege escalation vulnerability exists in GOG Galaxy 2.0.46. Due to insufficient folder permissions, an attacker can hijack the %ProgramData%\\GOG.com folder structure and change the GalaxyCommunication service executable to a malicious file, resulting in code execution as SYSTEM.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00512,"percentile":0.44164,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-281"],"published":"2022-08-17T14:37:42Z","modified":"2026-06-17T04:45:15Z","exploits":[{"source":"pocgithub","id":"secure-77/CVE-2022-31262","title":"secure-77/CVE-2022-31262","date":"2022-08-11","url":"https://github.com/secure-77/CVE-2022-31262"}],"products":[{"vendor":"gog","product":"galaxy"}],"references":[{"url":"https://secure77.de/category/subjects/researches/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://secure77.de/gog-galaxy-cve-2022-31262/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://github.com/secure-77/CVE-2022-31262","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://www.youtube.com/watch?v=Bgdbx5TJShI","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31262"},{"url":"https://github.com/advisories/GHSA-mwfm-4frv-j42h"}],"sources":{"cve":[{"id":"CVE-2022-31262","description":"An exploitable local privilege escalation vulnerability exists in GOG Galaxy 2.0.46. Due to insufficient folder permissions, an attacker can hijack the %ProgramData%\\GOG.com folder structure and change the GalaxyCommunication service executable to a malicious file, resulting in code execution as SYSTEM.","status":"published","published":"2022-08-17T14:37:42Z","modified":"2024-08-03T07:11:39.895Z","updated_at":"2026-11-02T14:34:35.279735Z"}],"euvd":[{"id":"EUVD-2022-52838","description":"An exploitable local privilege escalation vulnerability exists in GOG Galaxy 2.0.46. Due to insufficient folder permissions, an attacker can hijack the %ProgramData%\\GOG.com folder structure and change the GalaxyCommunication service executable to a malicious file, resulting in code execution as SYSTEM.","status":"published","published":"2022-08-17T14:37:42Z","modified":"2024-08-03T07:11:39Z","updated_at":"2026-11-03T03:25:34.735493Z"}],"ghsa":[{"id":"GHSA-mwfm-4frv-j42h","title":"An exploitable local privilege escalation vulnerability exists in GOG Galaxy 2.0.46. Due to...","description":"An exploitable local privilege escalation vulnerability exists in GOG Galaxy 2.0.46. Due to insufficient folder permissions, an attacker can hijack the %ProgramData%\\GOG.com folder structure and change the GalaxyCommunication service executable to a malicious file, resulting in code execution as SYSTEM.","status":"published","published":"2022-08-18T00:00:17Z","modified":"2023-01-29T05:03:47Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-281"],"updated_at":"2026-11-02T14:45:24.208268Z"}],"nvd":[{"id":"CVE-2022-31262","description":"An exploitable local privilege escalation vulnerability exists in GOG Galaxy 2.0.46. Due to insufficient folder permissions, an attacker can hijack the %ProgramData%\\GOG.com folder structure and change the GalaxyCommunication service executable to a malicious file, resulting in code execution as SYSTEM.","status":"published","published":"2022-08-17T15:15:08.307Z","modified":"2026-06-17T04:45:15.037Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-281"],"updated_at":"2026-11-02T14:07:25.242752Z"}]}}