CVE-2023-53946 Arcsoft PhotoStudio 6.0.0.172 Unquoted Service Path Privilege Escalation
Local attackers can escalate privileges to system level by placing a malicious executable in the unquoted service path of Arcsoft PhotoStudio.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-53946?
CVE-2023-53946 is a high-severity vulnerability in Arcsoft PhotoStudio, published on 19 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Arcsoft PhotoStudio 6.0.0.172 contains an unquoted service path vulnerability in the ArcSoft Exchange Service that allows local attackers to escalate privileges. Attackers can place a malicious executable in the unquoted path and trigger the service to execute arbitrary code with system-level permissions.
Weakness: CWE-428
Which versions are affected by CVE-2023-53946?
How do I fix CVE-2023-53946?
No fix has been published for CVE-2023-53946 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-53946 being exploited?
There is no known exploitation of CVE-2023-53946 in the wild and no public exploit code.
Sources
Also known as GHSA-442c-qj97-8m6f.