CVE-2024-11872 HIGH

CVE-2024-11872: Epic Games Launcher Incorrect Default Permissions Local Privilege Escalation Vulnerability

Vendor Epic Games
Product Epic Games Launcher
Weakness CWE-276
Published December 11, 2024
Last update December 12, 2024

CVSS base score

7.8/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Epic Games Launcher Incorrect Default Permissions Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Epic Games Launcher. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the product installer. The product applies incorrect default permissions to a sensitive folder. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-24329.

Key dates

02Disclosure timeline

December 11, 2024 CVE published
December 12, 2024 Record updated