CVE-2018-4048

This is a permissions mistake in a temporary storage area used during installation. It is like leaving a trusted employee’s master key in an unlocked supply closet: someone already inside the building could swap it for their own key and gain access to everything on that computer.

This matters to you if your Windows computers use GOG Galaxy, particularly the 1.2.48.36 64-bit installer and its Desktop Galaxy Updater. It is only a risk if an attacker can already sign in to the affected computer with a normal user account.

There is no confirmed active exploitation and no public exploit code recorded, so this is an amber-priority issue rather than an emergency. Address it during the next practical IT maintenance window, with priority for shared or publicly accessible Windows computers where untrusted people may obtain a local login.

Confirm whether the affected Windows endpoints have GOG Galaxy 1.2.48.36 installed and whether the Desktop Galaxy Updater files are present. Inspect the permissions on the relevant Temp directory and updater executable locations for write access by non-administrative users.

No vendor fixed version or patch is available in the supplied findings, so do not assume that reinstalling the same version resolves the issue. Obtain a supported updated installer or removal guidance from GOG before redeploying the product.

If patching or replacement is delayed, remove the vulnerable installer from systems where it is not needed, restrict interactive local access to trusted users, and correct overly broad write permissions on the affected temporary directory and updater files. Monitor for unexpected executable replacements, unusual updater launches, and local privilege-escalation alerts. CVE-2018-4048 is not listed in CISA KEV, so there is no CISA remediation due date.

CVE-2018-4048 is rated CVSS 7.8 High (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The issue is CWE-668, involving improper access control over the Temp directory; a local low-privileged attacker can overwrite Desktop Galaxy Updater executables and obtain SYSTEM-level code execution. The attack vector is local and requires low privileges, with no user interaction. It is not listed in CISA KEV, no public exploit code is on record, and EPSS predicts 0.6% likelihood (47th percentile) with a flat trend. Press attention is rising, but that does not establish exploitation.