GOG Galaxy GalaxyClientService Privilege Escalation

published 2020-08-06 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-28479

cvss: 8.4; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 3.8%; EPSS 3.8% chance of exploitation in 30 days, percentile 90%
public exploits: 1; Metasploit

The GalaxyClientService component of GOG Galaxy runs with elevated SYSTEM privileges in a Windows environment. Due to the software shipping with embedded, static RSA private key, an attacker with this key material and local user permissions can effectively send any operating system command to the service for execution in this elevated context. The service listens for such commands on a locally-bound network port, localhost:9978. A Metasploit module has been published which exploits this vulnerability. This issue affects the 2.0.x branch of the software (2.0.12 and earlier) as well as the 1.2.x branch (1.2.64 and earlier). A fix was issued for the 2.0.x branch of the affected software.

Patch / fix

links 1

github.com/rapid7/metasploit-framework#13444 pull request

Timeline

2020-04-28 First public exploit (Metasploit exploit/windows/local/gog_galaxyclientservice_privesc)
2020-08-06 Published

Exploit prediction

3.78% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit exploit/windows/local/gog_galaxyclientservice_privesc GOG GalaxyClientService Privilege Escalation metasploit exploit, excellent rank, 2020-04-28
positronsecurity.com https://www.positronsecurity.com/blog/2020-04-28-gog-galaxy-client-local-privilege-escalation/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.4	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
NVD	3.1	8.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD	2.0	7.2	AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected products

GOG GOG GalaxyClientService

Classification

Weakness

CWE-264 Permissions, Privileges, and Access Controls
CWE-798 Use of Hard-coded Credentials

References

github.com /rapid7/metasploit-framework/pull/13444
patch, third-party-advisory
positronsecurity.com /blog/2020-04-28-gog-galaxy-client-local-privilege-escalation/
exploit, third-party-advisory

Sources

CVE List CVE-2020-7352
NVD CVE-2020-7352

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary