A local privilege escalation vulnerability in Outline 1.6.0 permits attackers to execute arbitrary code with elevated system privileges by leveraging an unquoted service path.

The application utilizes an unquoted service path for the OutlineService executable. This flaw allows a local user to place a malicious binary in a directory within the path, which the service will execute with LocalSystem privileges upon restart.

Successful exploitation of this vulnerability results in full system compromise. Because the service runs with LocalSystem privileges, an attacker can bypass standard user restrictions, install persistent backdoors, or access sensitive data across the entire host. Given the CVSS score of 8.4, this vulnerability represents a high risk to organizational security and infrastructure integrity.

Immediate Action: Upgrade to the latest version of Outline where this service path has been corrected to use proper quoting. If an immediate update is not feasible, manually modify the Windows Registry to wrap the service path in quotes.

Proactive Monitoring: Review Windows Service configurations and audit access logs for unexpected service restarts or modifications to system directories. Monitor for the creation of unauthorized executable files within the C:\Program Files (x86)\ directory.

Compensating Controls: Implement strict file system permissions on the C:\Program Files (x86)\ directory to prevent non-privileged users from creating or modifying files. Ensure that the Principle of Least Privilege is enforced for all local user accounts.

Public Exploit Available: Yes — a local exploit is documented on ExploitDB (EDB-ID: 51128).

This vulnerability presents a significant risk due to the potential for total system compromise via local privilege escalation. Administrators should prioritize patching the Outline application or applying the manual registry fix to ensure service paths are properly quoted. Prompt remediation is necessary to prevent local threats from gaining administrative control over the host environment.