A local privilege escalation vulnerability in PDF Complete Corporate Edition 4.1.45 allows attackers to execute arbitrary code with LocalSystem privileges due to an unquoted service path.

The application utilizes an unquoted service path for the pdfcDispatcher service, which fails to properly handle spaces in the file path. A local attacker can exploit this by placing a malicious executable in a directory that the service path resolves, resulting in the execution of the payload with LocalSystem privileges.

The exploitation of this vulnerability results in full system compromise, as the malicious code runs with the highest level of administrative permissions on the affected Windows host. This allows an attacker to install persistent backdoors, exfiltrate sensitive data, or disable security controls. While the CVSS score of 7.8 indicates a high severity, the requirement for local access necessitates that organizations prioritize this for systems where untrusted users or applications may have limited local execution rights.

Immediate Action: Since a specific patch is not confirmed, administrators should manually modify the Windows Service configuration to quote the path for the pdfcDispatcher service or move the executable to a secure, non-writable location.

Proactive Monitoring: Monitor system logs for the creation of unauthorized executables in the C:\Program Files (x86)\ or C:\Program Files\ directories, particularly those matching service names.

Compensating Controls: Ensure that standard users are restricted from writing files to the root of the system drive or the Program Files directory to prevent the placement of malicious service binaries.

Public Exploit Available: Yes, a local exploit is documented in the Exploit Database (EDB-ID 49558).

Given the availability of a public proof-of-concept and the potential for full system compromise, this vulnerability poses a significant risk to internal security. Organizations should audit their installations of PDF Complete Corporate Edition and implement the recommended service path hardening immediately to prevent unauthorized privilege escalation.