Vulnerable Location

RzUpdateEngineService.exe (v1.10.14.0) at C:\Program Files (x86)\Razer\RzUpdateEngineService\

Vulnerability Description and Specific Impact

The Razer software update service RzUpdateService.exe creates the named pipe:

\\.\pipe\F4D89D9A-E6D3-4628-AF18-B0360861F3D5

with an Everyone: READ | WRITE access control list (ACL).

When the pipe receives a Base64-encoded message with ID = 2, the service decodes it into an internal structure and spawns a helper thread.

Within this thread, the following call to CreateProcessW() is made:

CreateProcessW(
    NULL,                            // lpApplicationName
    (LPWSTR)lpThreadParameter + 520, // lpCommandLine (attacker-controlled)
    ...,
    0x80000004u,                     // CREATE_NO_WINDOW | CREATE_SUSPENDED
    ...
);

The lpThreadParameter buffer is populated directly from user-supplied pipe data. As a result, any local user can inject an arbitrary command line (e.g., “cmd.exe /c …”) into a process created by a SYSTEM service.

Since RzUpdateService.exe runs with NT AUTHORITY\SYSTEM privileges, this results in local privilege escalation (to SYSTEM) and arbitrary code execution, without requiring any user interaction.

Affected Products

The following Razer applications are affected, as they all install and run RzUpdateService.exe:

• THX Spatial Audio
• Streamer Companion App
• Razer Virtual Ring Light
• 7.1 Surround Sound

All of these applications inherit the same vulnerability through the shared service.