A local privilege escalation vulnerability in Popcorn Time 6.2.1.14 allows low-privileged users to achieve full system compromise by exploiting an unquoted service path.

The application installs a service with an unquoted file path, which permits a local, authenticated user to place malicious executables in the path hierarchy. Upon service startup, the system executes the attacker-supplied code with SYSTEM-level privileges.

Successful exploitation grants an attacker full control over the affected machine, leading to complete system compromise. This risk is significant because it allows a low-privileged user to bypass security boundaries, potentially leading to unauthorized data access, the installation of persistent backdoors, or lateral movement within the network. The CVSS score of 7.8 reflects the high severity of achieving elevated privileges on a local system.

Immediate Action: Since no official patch is currently available, administrators should restrict folder permissions on the affected drive paths to ensure that only authorized accounts have write access to the directories containing the vulnerable service path.

Proactive Monitoring: Monitor Windows Event Logs for unexpected service installations or modifications, and audit the "Update service" configuration using the sc qc command to verify if the Binary_Path_Name is properly quoted.

Compensating Controls: Implement strict Application Whitelisting (AWL) policies to prevent the execution of unauthorized or untrusted binaries from system directories.

Public Exploit Available: Yes, a local exploit is documented on ExploitDB (EDB-ID: 48378).

Given the availability of a public proof-of-concept and the high-impact nature of local privilege escalation, organizations should prioritize restricting local user permissions. If the application is not business-critical, uninstalling the software is the most effective way to eliminate this risk until a vendor-supplied update is released.