Read the docs
TI-2022-23660 Aliases CVE-2022-47632GHSA-987j-8w57-9rmv

Razer Synapse before 3.7.0830.081906 allows privilege escalation due to an unsafe…

Priority HIGH 65CWE-427Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-427.

Summary

Razer Synapse before 3.7.0830.081906 allows privilege escalation due to an unsafe installation path, improper privilege management, and improper certificate validation. Attackers can place malicious DLLs into %PROGRAMDATA%\Razer\Synapse3\Service\bin if they do so before the service is installed and if they deny write access for the SYSTEM user. Although the service will not start if the malicious DLLs are unsigned, it suffices to use self-signed DLLs. The validity of the DLL signatures is not checked. As a result, local Windows users can abuse the Razer driver installer to obtain administrative privileges on Windows.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00651 51st percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:razer:synapse:*:*:*:*:*:*:*:*before 3.7.0830.081906VulnerableRazer
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:razer:synapse:*:*:*:*:*:*:*:* Versions before 3.7.0830.081906 Vulnerable ·Razer
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-47632
  2. 2026-10-03 Alias added: GHSA-987j-8w57-9rmv
  3. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Exploit 2

Other 3

  • TI-2017-07151 A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse… CVSS 3.1CRITICAL 9.8
  • TI-2017-08627 Razer Synapse 2.20.15.1104 and earlier uses weak permissions for the CrashReporter… CVSS 3.1HIGH 8.4
  • TI-2025-09056 Link following in Razer Synapse 3 CVSS 3.0HIGH 7.8
  • TI-2025-09055 Link following in Razer Synapse 3 CVSS 3.0HIGH 7.8
  • TI-2025-09054 Link following in Razer Synapse 3 CVSS 3.0HIGH 7.8
  • TI-2022-23659 Razer Synapse through 3.7.1209.121307 allows privilege escalation due to an unsafe… CVSS 3.1HIGH 7.8
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences