A critical unquoted service path vulnerability in ProtonVPN 1.26.0 allows local attackers to execute arbitrary code with elevated system privileges.

The application employs an unquoted search path for the WireGuard service, which contains whitespace. A local attacker can exploit this by placing a malicious executable in a parent directory, causing the service to run the attacker-supplied file with LocalSystem privileges upon startup.

Successful exploitation allows a local user to gain full control over the affected system by elevating their privileges to the LocalSystem level. Given the CVSS score of 8.4, this vulnerability represents a high risk to organizational security, as it facilitates complete system compromise, potential data exfiltration, and the installation of persistent malicious backdoors.

Immediate Action: Upgrade to the latest available version of the ProtonVPN software provided by the vendor to ensure the service path is correctly quoted.

Proactive Monitoring: Monitor system logs for unauthorized service installation or modifications to executable paths within the Program Files or ProgramData directories.

Compensating Controls: Restrict write permissions on the C:\Program Files and C:\ProgramData directories to administrative users only, preventing unauthorized actors from placing malicious files in the path of the vulnerable service.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the Exploit-DB entry 50837.

This vulnerability presents a significant risk for local privilege escalation and must be prioritized for remediation. Organizations should audit their installations to identify any active instances of version 1.26.0 and apply the vendor-provided security updates immediately to eliminate this attack vector.