Suricata <7.0.17 / <8.0.6 Windows Service LPE via Unquoted ImagePath
CVE-2026-57223 Published on September 18, 2026
Suricata windows: unquoted LocalSystem service ImagePath can allow local privilege escalation
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the Windows service installation and parameter-update logic in src/win32-service.c can pass an unquoted service ImagePath to CreateServiceA. When Suricata is installed below a path containing spaces and an earlier path component is writable by a local low-privileged attacker, Windows can execute an attacker-controlled program as LocalSystem, resulting in local privilege escalation. This issue is fixed in versions 8.0.6 and 7.0.17.
Vulnerability Analysis
CVE-2026-57223 can be exploited with local system access, and requires small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
Unquoted Search Path or Element
The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path. If a malicious individual has access to the file system, it is possible to elevate privileges by inserting such a file as "C:\Program.exe" to be run by a privileged program making use of WinExec.
Products Associated with CVE-2026-57223
Want to know whenever a new CVE is published for Oisf Suricata? stack.watch will email you.
Affected Versions
OISF suricata:- Version >= 8.0.0, < 8.0.6 is affected.
- Version < 7.0.17 is affected.