Epic Games Launcher Incorrect Default Permissions Local Privilege Escalation Vulnerability
CVE-2024-11872

7.8HIGH

Key Information:

Vendor

Epic Games

Status
Epic Games Launcher
Vendor
CVE Published:
12 December 2024

What is CVE-2024-11872?

The vulnerability in the Epic Games Launcher is a local privilege escalation issue stemming from incorrect default permissions set on a sensitive folder during the product installation process. This design flaw allows local attackers, who have already gained the ability to execute code with low privileges, to exploit the vulnerability. By leveraging this defect, an attacker can potentially escalate their privileges to execute arbitrary code with SYSTEM permissions, significantly compromising the integrity and security of the affected system. Users are advised to follow best security practices and apply any recommended updates to mitigate the risks associated with this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Epic Games Launcher 16.6.0-33806133

References

https://www.zerodayinitiative.com/advisories/ZDI-24-1646/
x_research-advisory
https://trello.com/c/tcS6Jcfy/578-epic-games-launcher-1720
vendor-advisory

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

JSON
.