Executive brief
Wondershare PDFelement is a popular application used for creating, editing, and managing PDF documents. A security flaw in version 5.2.9 allows a person with limited access to a Windows computer to gain full administrative control (LocalSystem privileges). This could allow an attacker to bypass security restrictions, access sensitive files, or install persistent malicious software on the affected machine.
Technical details
A privilege escalation vulnerability exists in Wondershare PDFelement 5.2.9 due to an unquoted search path (CWE-428) in the 'WsAppService' Windows service (Wondershare Application Framework Service). The service's binary path, 'C:\Program Files\Wondershare\WAF\2.2.3.2\WsAppService.exe', is not enclosed in quotation marks, allowing Windows to interpret spaces in the path as delimiters. A local attacker with low privileges can place a malicious executable (e.g., 'C:\Program.exe') in the file system. When the service restarts or the system reboots, the Windows Service Control Manager will execute the attacker's file with LocalSystem privileges. This vulnerability requires local access to the target machine and the ability to write to the root or intermediate directories of the service path.
Affected products
- Wondershare PDFelement 5.2.9
Timeline
- 2016-10-14: disclosed: Initial discovery and exploit published on Exploit-DB
- 2026-06-19: advisory: NVD/VulnCheck advisory published