Executive brief
Winstep Xtreme is a desktop customization suite for Windows. A security flaw in its background service allows a local user with limited permissions to gain full administrative control over the computer. By placing a specially named file in a specific folder, an attacker can trick the system into running their malicious code with the highest possible system privileges when the computer starts.
Technical details
The Winstep Xtreme Service (WsxService) is configured with an unquoted executable path containing spaces (C:\Program Files\Winstep\WsxService). Due to how Windows handles service execution, this creates a CWE-428 vulnerability where the Service Control Manager attempts to locate the executable by appending .exe to each fragment of the path. A local attacker with write permissions to the parent directory (e.g., C:\) could place a malicious file named 'Program.exe' to intercept the service start. Successful exploitation allows the attacker's code to run with LocalSystem privileges. This vulnerability affects version 18.06.0096 and potentially earlier versions.
Affected products
- Winstep Winstep Xtreme Service 18.06.0096 and earlier
Timeline
- 2020-11-08: disclosed: Initial exploit discovery and PoC creation
- 2020-11-09: other: Exploit published on Exploit-DB
- 2026-06-19: advisory: NVD publication date