Executive brief
BlueStacks App Player, a popular software for running Android mobile applications on Windows and Mac, contains a security flaw in its log rotation service. A local attacker with limited access to a computer can exploit this to run their own malicious programs with elevated system permissions. This could lead to a full takeover of the affected machine, potentially compromising all user data and system operations.
Technical details
An unquoted service path vulnerability (CWE-428) exists in the BstHdLogRotatorSvc service of BlueStacks App Player version 2.4.44.62.57. The service executable path (C:\Program Files (x86)\Bluestacks\HD-LogRotatorService.exe) is not enclosed in quotation marks, which allows a local attacker to place a malicious executable in a parent directory (e.g., C:\Program.exe). Because the service runs with LocalSystem privileges, the injected code will execute with high-level permissions upon service start or restart. This requires local access to the file system but no user interaction. A proof-of-concept exploit has been publicly disclosed.
Affected products
- BlueStacks BlueStacks App Player 2.4.44.62.57
Timeline
- 2019-11-05: disclosed: Initial exploit published on Exploit-DB
- 2026-02-06: advisory: CVE-2019-25293 published by NVD/VulnCheck