A local privilege escalation vulnerability in IDT PC Audio allows attackers with local access to gain full system privileges by exploiting an unquoted service path.

This vulnerability involves an unquoted service path in the STacSV service, which allows a local attacker to insert malicious executables into the system search path. When the service starts, it executes the injected code with LocalSystem account permissions.

Successful exploitation of this vulnerability grants an attacker full control over the affected system. Because the malicious code executes with LocalSystem privileges, an attacker can bypass standard security restrictions, install persistent backdoors, or exfiltrate sensitive data. Given the CVSS score of 7.8, this poses a significant risk to the integrity and confidentiality of any host running the affected software.

Immediate Action: As no specific patch version is documented for this legacy software, administrators should restrict file system permissions on the affected directories to prevent unauthorized modification. If the software is no longer required, uninstall the IDT PC Audio driver immediately.

Proactive Monitoring: Monitor system logs for unauthorized service installations or modifications to the STacSV service configuration. Review file integrity logs for any unexpected executables placed within the C:\Program Files\IDT\ directory structure.

Compensating Controls: Implement Endpoint Detection and Response (EDR) solutions to identify and block suspicious child processes spawned by system services. Ensure that non-administrative users are restricted from writing to application directories.

Public Exploit Available: Yes, a public exploit exists as documented in the Exploit Database (EDB-ID: 49191).

Given the availability of a public exploit and the high potential for privilege escalation, organizations must prioritize the mitigation of this vulnerability. If the software cannot be uninstalled, ensure that strict access control lists are applied to the installation directory to prevent unauthorized modification, and perform a thorough audit of all systems to identify instances of this legacy driver.