CVE-2022-31262: Gog Galaxy

High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days.

An exploitable local privilege escalation vulnerability exists in GOG Galaxy 2.0.46. Due to insufficient folder permissions, an attacker can hijack the %ProgramData%\GOG.com folder structure and change the GalaxyCommunication service executable to a malicious file, resulting in code execution as SYSTEM.

Affected products

• Gog Galaxy: from 2.0.46, up to and including 2.0.51

Published 2022-08-17. Last modified 2026-06-17.