Uncontrolled search path in Windscribe
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-427.
Summary
This vulnerability allows local attackers to escalate privileges on affected installations of Windscribe. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the configuration of OpenSSL. The product loads an OpenSSL configuration file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-16859.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Windscribe | Windscribe | 2.3 Build 16 | — | No fix listed | CNA |
- Windscribe VendorWindscribe Affected 2.3 Build 16 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:windscribe:windscribe:2.3.16:*:*:*:*:windows:*:* | 2.3.16 | Vulnerable | Windscribe |
- cpe:2.3:a:windscribe:windscribe:2.3.16:*:*:*:*:windows:*:* Versions 2.3.16 Vulnerable ·Windscribe
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-41141
- 2026-10-03 Alias added: GHSA-5fgv-xg7g-3m2v
References
More Windscribe vulnerabilities
- TI-2018-08203 The VPN component in Windscribe 1.81 uses the OpenVPN client for connections. CVSS 3.0HIGH 7.8
- TI-2025-40286 Windscribe for Linux 'changeMTU' local privilege escalation CVSS 4.0HIGH 7.3
- TI-2024-05690 Path traversal in Windscribe CVSS 3.1HIGH 7.8
- TI-2020-16687 All versions of Windscribe VPN for Mac and Windows <= v2.02.10 contain a local privilege… CVSS 3.1HIGH 7.8
- TI-2020-14401 In Windscribe v1.83 Build 20, 'WindscribeService' has an Unquoted Service Path that facilitates privilege escalation. CVSS 3.1HIGH 7.8
- TI-2018-08079 Windscribe 1.81 creates a named pipe with a NULL DACL that allows Everyone users to gain… CVSS 3.0HIGH 7.8
Sources
- CVE-2022-41141 · CVE Program
- CVE-2022-41141 · NVD
- FIRST EPSS
- GHSA-5fgv-xg7g-3m2v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences