The VPN component in Windscribe 1.81 uses the OpenVPN client for connections.
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA.
Summary
The VPN component in Windscribe 1.81 uses the OpenVPN client for connections. Also, it creates a WindScribeService.exe system process that establishes a \\.\pipe\WindscribeService named pipe endpoint that allows the Windscribe VPN process to connect and execute an OpenVPN process or other processes (like taskkill, etc.). There is no validation of the program name before constructing the lpCommandLine argument for a CreateProcess call. An attacker can run any malicious process with SYSTEM privileges through this named pipe.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:windscribe:windscribe:1.81:*:*:*:*:*:*:* | 1.81 | Vulnerable | Windscribe |
- cpe:2.3:a:windscribe:windscribe:1.81:*:*:*:*:*:*:* Versions 1.81 Vulnerable ·Windscribe
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2018-11479
- 2026-10-03 Alias added: GHSA-mcm6-4273-92rf
References
More Windscribe vulnerabilities
- TI-2025-40286 Windscribe for Linux 'changeMTU' local privilege escalation CVSS 4.0HIGH 7.3
- TI-2024-05690 Path traversal in Windscribe CVSS 3.1HIGH 7.8
- TI-2022-19660 Uncontrolled search path in Windscribe CVSS 3.1HIGH 7.8
- TI-2020-16687 All versions of Windscribe VPN for Mac and Windows <= v2.02.10 contain a local privilege… CVSS 3.1HIGH 7.8
- TI-2020-14401 In Windscribe v1.83 Build 20, 'WindscribeService' has an Unquoted Service Path that facilitates privilege escalation. CVSS 3.1HIGH 7.8
- TI-2018-08079 Windscribe 1.81 creates a named pipe with a NULL DACL that allows Everyone users to gain… CVSS 3.0HIGH 7.8
Sources
- CVE-2018-11479 · CVE Program
- CVE-2018-11479 · NVD
- FIRST EPSS
- GHSA-mcm6-4273-92rf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences