Read the docs
TI-2018-03016 Aliases CVE-2018-4048GHSA-cxcg-fx4q-4w62

Exposure of resource to wrong sphere in Talos GOG Galaxy

Priority LOW 35CWE-668Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

An exploitable local privilege elevation vulnerability exists in the file system permissions of the `Temp` directory in GOG Galaxy 1.2.48.36 (Windows 64-bit Installer). An attacker can overwrite executables of the Desktop Galaxy Updater to exploit this vulnerability and execute arbitrary code with SYSTEM privileges.

Why it matters now

EPSS 0.00598 48th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
TalosGOG GalaxyGog Galaxy 1.2.48.36 (Windows 64-bit Installer)—No fix listedCNA
  • GOG Galaxy VendorTalos Affected Gog Galaxy 1.2.48.36 (Windows 64-bit Installer) Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:gog:galaxy:1.2.48.36:*:*:*:*:*:*:*1.2.48.36VulnerableGOG.COM
  • cpe:2.3:a:gog:galaxy:1.2.48.36:*:*:*:*:*:*:* Versions 1.2.48.36 Vulnerable ·GOG.COM

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-4048
  2. 2026-10-03 Alias added: GHSA-cxcg-fx4q-4w62

References

Exploit 1

  • TI-2020-05946 GOG Galaxy GalaxyClientService Privilege Escalation CVSS 3.1HIGH 8.8
  • TI-2020-12225 An issue was discovered in GOG Galaxy Client 2.0.17. CVSS 3.1HIGH 7.8
  • TI-2020-12226 An issue was discovered in GOG Galaxy Client 2.0.17. CVSS 3.1HIGH 7.8
  • TI-2022-13295 An exploitable local privilege escalation vulnerability exists in GOG Galaxy 2.0.46. CVSS 3.1HIGH 7.8
  • TI-2021-08442 GalaxyClient version 2.0.28.9 loads unsigned DLLs such as zlib1.dll, libgcc_s_dw2-1.dll… CVSS 3.1HIGH 7.8
  • TI-2020-15055 The client (aka GalaxyClientService.exe) in GOG GALAXY through 2.0.41 (as of 12:58 AM… CVSS 3.1HIGH 7.8
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences