Executive brief
Planet9 is a background service component used by Acer systems that runs with system-level privileges. A configuration error grants excessive permissions to the application executable, allowing authenticated local users to replace it with malicious code that executes with the same system privileges when the service restarts or the system reboots.
Technical details
The vulnerability is a privilege escalation flaw resulting from incorrect file permissions (CWE-276) on an executable used by the Planet9 background service. The service operates with SYSTEM privileges, but the executable file permits write access to non-administrative users. An authenticated local attacker can exploit this by replacing or modifying the executable, achieving arbitrary code execution with SYSTEM privileges upon service restart or system boot. No patch information is currently available in the advisory.
Affected products
- Acer Planet9
Timeline
- 2026-08-17: disclosed