A local privilege escalation vulnerability in BlueStacks App Player 2.4.44.62.57 allows attackers to execute arbitrary code with elevated system privileges.

The BstHdLogRotatorSvc service utilizes an unquoted service path, which causes the Windows service control manager to incorrectly interpret the path as multiple arguments. A local attacker with low-level privileges can place a malicious executable in the path to achieve arbitrary code execution as the LocalSystem account.

Successful exploitation allows an attacker who already has local access to the system to escalate their privileges to LocalSystem. This grants them full control over the affected machine, potentially leading to total system compromise, data theft, and the installation of persistent backdoors. Given the CVSS score of 7.8, this represents a significant risk to the integrity and confidentiality of any endpoint running the vulnerable software.

Immediate Action: Upgrade to a supported version of BlueStacks App Player that is no longer susceptible to this unquoted path flaw. If an update is unavailable, administrators should manually modify the service path configuration to be properly quoted or disable the vulnerable service if it is not required for operation.

Proactive Monitoring: Monitor system logs for the creation of unexpected executables within the C:\Program Files (x86)\ directory or subdirectories associated with BlueStacks. Review service configuration changes using tools like PowerShell or the Windows Services management console.

Compensating Controls: Implement strict file system permissions on the C:\Program Files (x86)\ directory to prevent unprivileged users from writing or modifying files in these locations. Use Endpoint Detection and Response (EDR) solutions to flag suspicious child processes spawned by service host executables.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the Exploit Database (EDB-ID: 47582).

Organizations should prioritize patching or reconfiguring the affected BlueStacks service immediately. Because this vulnerability facilitates privilege escalation from a standard user to a system-level account, it serves as a critical pivot point for attackers to maintain long-term persistence and total control over the host environment.