The flaw exists in the Windows Service which PGP Desktop installs, and could be used by any local or remote user to run code with escalated privileges.
Vulnerability testers NGS Software rated the flaw as a 'medium risk' and said that it affects versions of the software earlier than PGP Desktop 9.5.1.
"The vulnerability occurs because the code responsible for processing the objects passed over the interface to the service does not perform any kind of validation on these objects," said Peter Winter-Smith of NGS Software.
"Instead it trusts that the object data is completely safe in the form that it is received, i.e. absolute pointers are trusted without validation."
The company does not yet have a workaround and is urging all PGP Desktop users to upgrade as a matter of urgency.
.png&h=140&w=231&c=1&s=0)
.png&h=140&w=231&c=1&s=0)
_page-0001.jpg&w=100&c=1&s=0)
.png&w=100&c=1&s=0)
.png&w=120&c=1&s=0)
Tech in Gov 2025
Forrester's Technology & Innovation Summit APAC 2025
.png&w=120&c=1&s=0)
Security Exhibition & Conference 2025
Integrate Expo 2025
Digital As Usual Cybersecurity Roadshow: Brisbane edition
.jpg&h=140&w=231&c=1&s=0)
.jpg&h=140&w=231&c=1&s=0)
