A local privilege escalation vulnerability exists in PDF Complete 3.5.310.2002 that allows attackers to execute code with system-level permissions.

The application utilizes an unquoted service path for the pdfsvc.exe service, which is a flaw where the service path contains spaces but lacks surrounding quotes. This allows a local, authenticated attacker to place a malicious executable in a parent directory, which the system will then execute with elevated LocalSystem privileges instead of the intended binary.

Successful exploitation grants an attacker full control over the affected workstation or server. Because the malicious code runs with LocalSystem privileges, an attacker can bypass all user-level access controls, install persistent backdoors, exfiltrate sensitive data, or move laterally within the network. The CVSS score of 7.8 reflects the high severity of this local privilege escalation risk.

Immediate Action: Upgrade to the latest version of PDF Complete to ensure the service path is properly quoted. If an update is not available, administrators should manually modify the service path registry key to include quotes around the executable path.

Proactive Monitoring: Monitor system logs for unexpected service creation or modifications to service configuration registry keys. Review process execution logs for suspicious binaries running from within the Program Files directory.

Compensating Controls: Implement strict file system permissions on the C:\Program Files (x86)\ directory to prevent unprivileged users from creating files or folders in the path segments preceding the vulnerable binary.

Public Exploit Available: Yes — a local exploit is documented in the Exploit Database (EDB-ID 49226).

This vulnerability presents a significant risk to internal security by providing a direct path to full system compromise. Organizations running affected versions of PDF Complete should prioritize patching or manual registry remediation to remove the unquoted path flaw. Failure to remediate this issue leaves endpoints susceptible to local privilege escalation attacks that could lead to complete system takeover.