CVE-2021-47852
Privilege Escalation in Rockstar Games Launcher via Weak Service Permissions
Publication date: 2026-01-21
Last updated on: 2026-01-21
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| rockstar_games | rockstar_games_launcher | 1.0.37.349 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-276 | During installation, installed file permissions are set to allow anyone to modify those files. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2021-47852 is a privilege escalation vulnerability in Rockstar Games Launcher version 1.0.37.349. It occurs because the service executable, RockstarService.exe, has weak file permissions that allow any authenticated user with limited privileges to modify or replace it. An attacker can exploit this by substituting the legitimate executable with a malicious binary that, when run, creates a new administrator user on the system, thereby gaining elevated system-level access. [2, 3]
How can this vulnerability impact me? :
This vulnerability can allow an attacker who already has a limited authenticated user account on the affected system to escalate their privileges to administrator level. By replacing the RockstarService.exe with a malicious executable, the attacker can create a new administrator user, gaining full control over the system. This elevated access can lead to unauthorized system modifications, data theft, installation of malware, or further attacks on the network. [2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking the file permissions of the RockstarService.exe executable to see if the 'Authenticated Users' group has Modify (M) privileges, which should not be the case. On a Windows system, you can use the command 'icacls "<path_to_RockstarService.exe>"' to view the Access Control List (ACL) and verify if weak permissions are set that allow modification by authenticated users. [3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting the permissions on the RockstarService.exe executable to prevent modification by non-administrative users. Specifically, remove Modify permissions for the 'Authenticated Users' group and ensure only trusted administrators have write access to the service executable. Additionally, monitor for any unauthorized changes to the executable and consider applying any patches or updates provided by Rockstar Games once available. [2, 3]