Read the docs
TI-2018-02942 Aliases CVE-2018-3974GHSA-r33r-8f25-2v5p

Incorrect permission assignment in GOG.COM GOG Galaxy

Priority LOW 35CWE-732Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

An exploitable local privilege elevation vulnerability exists in the file system permissions of GOG Galaxy's install directory. An attacker can overwrite an executable that is launched as a system service on boot by default to exploit this vulnerability and execute arbitrary code with system privileges.

Why it matters now

EPSS 0.0053 45th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
GOG.COMGOG GalaxyGog Galaxy 1.2.45.61 (Windows 64-bit Installer)—No fix listedCNA
  • GOG Galaxy VendorGOG.COM Affected Gog Galaxy 1.2.45.61 (Windows 64-bit Installer) Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:gog:galaxy:1.2.45.61:*:*:*:*:*:*:*1.2.45.61VulnerableGOG.COM
  • cpe:2.3:a:gog:galaxy:1.2.45.61:*:*:*:*:*:*:* Versions 1.2.45.61 Vulnerable ·GOG.COM

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-3974
  2. 2026-10-03 Alias added: GHSA-r33r-8f25-2v5p

References

Exploit 1

  • TI-2020-05946 GOG Galaxy GalaxyClientService Privilege Escalation CVSS 3.1HIGH 8.8
  • TI-2020-12225 An issue was discovered in GOG Galaxy Client 2.0.17. CVSS 3.1HIGH 7.8
  • TI-2020-12226 An issue was discovered in GOG Galaxy Client 2.0.17. CVSS 3.1HIGH 7.8
  • TI-2022-13295 An exploitable local privilege escalation vulnerability exists in GOG Galaxy 2.0.46. CVSS 3.1HIGH 7.8
  • TI-2021-08442 GalaxyClient version 2.0.28.9 loads unsigned DLLs such as zlib1.dll, libgcc_s_dw2-1.dll… CVSS 3.1HIGH 7.8
  • TI-2020-15055 The client (aka GalaxyClientService.exe) in GOG GALAXY through 2.0.41 (as of 12:58 AM… CVSS 3.1HIGH 7.8
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences