CVE-2023-50915

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue exists in GalaxyClientService.exe in GOG Galaxy (Beta) 2.0.67.2 through 2.0.71.2 that could allow authenticated users to overwrite and corrupt critical system files via a combination of an NTFS Junction and an RPC Object Manager symbolic link and could result in a denial of service.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-288

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
gog	galaxy	>= 2.0.67.2, <= 2.071.2

References

Timeline

Published: Apr 30, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2023

CVE-2023-509167.2Kyocera Device Manager before 3.1.1213.0 allows NTLM credential exposure during UNC path authentication via a crafted change from a local pa CVE-2023-509179.8MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to CVE-2023-509189.8app/Controller/AuditLogsController.php in MISP before 2.4.182 mishandles ACLs for audit logs.CVE-2023-509199.8An issue was discovered on GL.iNet devices before version 4.5.0. There is an NGINX authentication bypass via Lua string pattern matching. Th CVE-2023-509205.5An issue was discovered on GL.iNet devices before version 4.5.0. They assign the same session ID after each user reboot, allowing attackers CVE-2023-509219.8An issue was discovered on GL.iNet devices through 4.5.0. Attackers can invoke the add_user interface in the system module to gain root priv CVE-2023-509227.2An issue was discovered on GL.iNet devices through 4.5.0. Attackers who are able to steal the AdminToken cookie can execute arbitrary code b CVE-2023-509234.3In QUIC in RFC 9000, the Latency Spin Bit specification (section 17.4) does not strictly constrain the bit value when the feature is disable CVE-2023-509245.4Englesystem is a shift planning system for chaos events. Engelsystem prior to v3.4.1 performed insufficient validation of user supplied data CVE-2023-509267.5Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bounds read can be caused by an inc CVE-2023-509277.5Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An attacker can trigger out-of-bounds reads i CVE-2023-509289.0"Sandbox Accounts for Events" provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-base