Executive brief
A vulnerability in Glarysoft Glary Utilities, a popular system maintenance and optimization tool, could allow a user with limited access to take full control of a Windows computer. By exploiting the software's disk cleaning feature, an attacker can trick the system into deleting critical files or running malicious code with the highest possible administrative permissions (SYSTEM). This could lead to a complete compromise of the machine, including the theft of sensitive data or the installation of persistent malware.
Technical details
A local privilege escalation vulnerability exists in Glarysoft Glary Utilities due to improper link resolution (CWE-59) within the Disk Clean functionality. An attacker with low-privileged code execution can create a directory junction to redirect file operations performed by the high-privileged Glary Utilities service. By abusing this service to delete arbitrary files, an attacker can manipulate system state to execute arbitrary code in the context of SYSTEM. The vulnerability was disclosed as a 0-day after the vendor failed to provide updates following the initial report in May 2025.
Affected products
- Glarysoft Glary Utilities 6.24.0.28
Timeline
- 2025-05-29: disclosed: Vulnerability reported to vendor
- 2026-07-08: advisory: Coordinated public release of advisory by Zero Day Initiative
- 2026-07-13: other: NVD publication date