What’s Vulnerable › Vulnerabilities

CVE-2023-50915

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-04-30 · updated 2026-06-17
• Weakness: CWE-288

Description

An issue exists in GalaxyClientService.exe in GOG Galaxy (Beta) 2.0.67.2 through 2.0.71.2 that could allow authenticated users to overwrite and corrupt critical system files via a combination of an NTFS Junction and an RPC Object Manager symbolic link and could result in a denial of service.

Affected products

• GOG.COM GOG Galaxy: from 2.0.67.2 through 2.071.2

References

• https://github.com/anvilsecure/gog-galaxy-app-research
• https://github.com/anvilsecure/gog-galaxy-app-research/blob/main/advisories/CVE-2023-50915%20-%20DoS.md
• https://support.gog.com/hc/en-us/categories/201553005-Downloads-Installing?product=gog
• https://github.com/anvilsecure/gog-galaxy-app-research
• https://github.com/anvilsecure/gog-galaxy-app-research/blob/main/advisories/CVE-2023-50915%20-%20DoS.md
• https://support.gog.com/hc/en-us/categories/201553005-Downloads-Installing?product=gog

Get alerted when CVE-2023-50915 or the next vulnerability affects your stack