Razer Synapse before 3.7.0228.022817 allows privilege escalation because it relies on…
Priority LOW 34CWE-427Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-427.
Summary
Razer Synapse before 3.7.0228.022817 allows privilege escalation because it relies on %PROGRAMDATA%\Razer\Synapse3\Service\bin even if %PROGRAMDATA%\Razer has been created by any unprivileged user before Synapse is installed. The unprivileged user may have placed Trojan horse DLLs there.
Why it matters now
EPSS 0.00903 59th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-44226
- 2026-10-03 Alias added: GHSA-rhvq-5663-3x4f
References
Exploit 3
Advisory 1
Other 4
- 20230126 [SYSS-2022-047] Razer Synapse - Local Privilege Escalation
- http://packetstormsecurity.com/files/170772/Razer-Synapse-3.7.0731.072516-Local-Privilege-Escalation.html
- 20230918 [SYSS-2023-002] Razer Synapse - Local Privilege Escalation
- http://packetstormsecurity.com/files/174696/Razer-Synapse-Race-Condition-DLL-Hijacking.html
More Razer Synapse vulnerabilities
- TI-2017-07151 A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse… CVSS 3.1CRITICAL 9.8
- TI-2022-23660 Razer Synapse before 3.7.0830.081906 allows privilege escalation due to an unsafe… CVSS 3.1MEDIUM 6.8
- TI-2017-08627 Razer Synapse 2.20.15.1104 and earlier uses weak permissions for the CrashReporter… CVSS 3.1HIGH 8.4
- TI-2025-09056 Link following in Razer Synapse 3 CVSS 3.0HIGH 7.8
- TI-2025-09055 Link following in Razer Synapse 3 CVSS 3.0HIGH 7.8
- TI-2025-09054 Link following in Razer Synapse 3 CVSS 3.0HIGH 7.8
Sources
- CVE-2021-44226 · CVE Program
- CVE-2021-44226 · NVD
- FIRST EPSS
- GHSA-rhvq-5663-3x4f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences