A high-severity privilege escalation vulnerability in the Fan Control application, version V251, allows a local user to execute actions with administrator-level privileges.

This vulnerability involves improper privilege handling within the Open File Dialog component. The application incorrectly processes user-supplied paths while running with elevated permissions, enabling a local authenticated attacker to leverage these privileges for unauthorized operations.

The potential for local privilege escalation poses a significant risk to system integrity and security. An attacker who successfully exploits this flaw can bypass standard user restrictions, leading to full compromise of the local host environment. With a CVSS score of 8.8, this vulnerability is classified as High severity, necessitating prompt attention to prevent unauthorized administrative control over the affected system.

Immediate Action: Update the Fan Control application to the latest version provided by the vendor, which includes the fix committed in repository 093ae0085ed8fe051f12e3c287e0927e6b819a7a.

Proactive Monitoring: Review system logs for unusual file access patterns or unexpected execution of administrative tasks by standard user accounts.

Compensating Controls: Restrict local user access to the application directory and ensure that the Principle of Least Privilege is applied to all user accounts on the host machine to limit the impact of potential local exploits.

Public Exploit Available: Yes, a public proof-of-concept exists via the technical write-up provided in the referenced GitHub Gist.

Given the High severity of this privilege escalation vulnerability and the presence of a published proof-of-concept, administrators should prioritize updating the Fan Control application. Applying the latest vendor-supplied patch is the most effective method to neutralize this risk and prevent unauthorized administrative access to the host system.