A critical unquoted service path vulnerability in VFS for Git allows local attackers to achieve arbitrary code execution with LocalSystem privileges.

The GVFS.Service Windows service utilizes an unquoted file path, which allows a local attacker to place a malicious executable in the path hierarchy. This vulnerability requires local access to the system, where a low privileged user can trigger execution of the malicious binary with LocalSystem permissions during service startup or system reboot.

The exploitation of this vulnerability results in full system compromise, as code is executed with the highest level of Windows system privileges. This grants an attacker complete control over the affected machine, potentially leading to unauthorized data access, the installation of persistent backdoors, or lateral movement within the network. With a CVSS score of 7.8, the risk is classified as High, reflecting the significant impact on system integrity and availability.

Immediate Action: Since a specific patch version is not currently identified in the available documentation, administrators should restrict file system permissions on the affected directory to prevent unauthorized users from writing files to the path used by the GVFS.Service.

Proactive Monitoring: Monitor Windows Event Logs for unexpected service restarts or new service creation events that may indicate an attempt to exploit the unquoted path.

Compensating Controls: Ensure that standard users do not have write access to the C:\Program Files directory or any subdirectories therein, effectively mitigating the ability to plant malicious binaries.

Public Exploit Available: Yes, a functional exploit is documented via ExploitDB (EDB-ID: 49661).

This vulnerability represents a significant security risk for any environment where VFS for Git is installed on Windows. Security teams must prioritize identifying systems running the vulnerable version and enforce strict directory access controls immediately. Given the availability of a public exploit, delaying remediation increases the window of opportunity for local attackers to escalate privileges to the LocalSystem level.