An unquoted service path vulnerability in the Outline Service allows local attackers to achieve privilege escalation to LocalSystem.

This is an unquoted search path vulnerability (CWE-428) in the Windows service configuration. Because the service executable path contains spaces and lacks quotes, a local user can place a malicious binary in a parent directory to intercept execution during service startup, effectively gaining LocalSystem privileges.

Successful exploitation allows an attacker with local access to execute arbitrary code with the highest level of system privileges. This leads to a total compromise of the affected host, including the ability to install backdoors, access sensitive data, or disable security controls. Given the CVSS score of 7.8, this represents a significant risk to the confidentiality, integrity, and availability of any system running the vulnerable service.

Immediate Action: Update the Outline Service to the latest available version provided by the vendor to ensure the binary path is correctly quoted and secured.

Proactive Monitoring: Review Windows service configurations for unquoted paths using tools like WMIC or PowerShell to identify other potential vulnerabilities in the environment.

Compensating Controls: Restrict write permissions on the C:\Program Files (x86)\ directory to prevent unauthorized users from placing malicious binaries in the path.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the Exploit-DB entry 48414.

The vulnerability presents a clear path to full system compromise for local attackers. Administrators should prioritize updating the Outline Service immediately to remediate the unquoted service path. If an update cannot be applied, ensure that standard user permissions are strictly enforced on the installation directory to prevent the placement of malicious binaries.