CVE-2022-41141 Privilege escalation in Windscribe

High 7.8 Published 26 Jan 2023 Updated 1 Apr 2025

Local attackers can escalate privileges to SYSTEM by exploiting an insecure OpenSSL configuration file load in Windscribe.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-41141?

CVE-2022-41141 is a high-severity vulnerability in Windscribe, published on 26 Jan 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

This vulnerability allows local attackers to escalate privileges on affected installations of Windscribe. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the configuration of OpenSSL. The product loads an OpenSSL configuration file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-16859.

Weakness: CWE-427

Which versions are affected by CVE-2022-41141?

It affects 1 product.

Products include Windscribe Windscribe.

How do I fix CVE-2022-41141?

No fix has been published for CVE-2022-41141 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-41141 being exploited?

There is no known exploitation of CVE-2022-41141 in the wild and no public exploit code.

Sources

Also known as GHSA-5fgv-xg7g-3m2v.