Executive brief
Chromacam is a virtual camera application used to replace or blur backgrounds during video calls on platforms like Zoom and Teams. A security flaw in how the software starts its background service allows a local user with limited permissions to trick the system into running a malicious program instead of the legitimate one. If exploited, this could allow an attacker to gain full administrative control over the computer, potentially leading to data theft or permanent system compromise.
Technical details
The PsyFrameGrabberService in Chromacam 4.0.3.0 (and potentially earlier versions) is configured with an unquoted executable path containing spaces (C:\Program Files (x86)\Personify\ChromaCam\64\PsyFrameGrabberService.exe). Because the path is not enclosed in quotation marks, the Windows Service Control Manager may attempt to execute files at intercepted locations such as 'C:\Program.exe' or 'C:\Program Files (x86)\Personify.exe'. A local attacker with write permissions to these directories can place a malicious executable that will be launched with LocalSystem privileges when the service starts automatically at boot. This is a classic CWE-428 vulnerability requiring local access but resulting in full privilege escalation.
Affected products
- Personify Chromacam 4.0.3.0 and earlier
Timeline
- 2023-01-19: disclosed: Vulnerability discovered by Laguin Benjamin
- 2023-04-03: other: Exploit published on Exploit-DB
- 2026-06-19: advisory: CVE published and NVD record created