What’s Vulnerable › Vulnerabilities

CVE-2019-15511

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-11-21 · updated 2026-06-17
• Weakness: CWE-306

Description

An exploitable local privilege escalation vulnerability exists in the GalaxyClientService installed by GOG Galaxy. Due to Improper Access Control, an attacker can send unauthenticated local TCP packets to the service to gain SYSTEM privileges in Windows system where GOG Galaxy software is installed. All GOG Galaxy versions before 1.2.60 and all corresponding versions of GOG Galaxy 2.0 Beta are affected.

Affected products

• GOG.COM GOG Galaxy: before 1.2.60; from 2.0.0 through 2.0.8 — fixed in 1.2.60

How to fix

Upgrade to a fixed version: GOG.COM GOG Galaxy 1.2.60. Check the vendor advisory for mitigations.

References

• https://cqureacademy.com/cqure-labs/cqlabs-cve-2019-15511-broken-access-control-in-gog-galaxy
• https://support.gog.com/hc/en-us/articles/360025458833-GOG-GALAXY-2-0-updates-and-known-issues
• https://cqureacademy.com/cqure-labs/cqlabs-cve-2019-15511-broken-access-control-in-gog-galaxy
• https://support.gog.com/hc/en-us/articles/360025458833-GOG-GALAXY-2-0-updates-and-known-issues

Get alerted when CVE-2019-15511 or the next vulnerability affects your stack