CVE-2026-57223: Suricata windows: unquoted LocalSystem service ImagePath can allow local privilege escalation
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the Windows service installation and parameter-update logic in src/win32-service.c can pass an unquoted service ImagePath to CreateServiceA. When Suricata is installed below a path containing spaces and an earlier path component is writable by a local low-privileged attacker, Windows can execute an attacker-controlled program as LocalSystem, resulting in local privilege escalation. This issue is fixed in versions 8.0.6 and 7.0.17.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Suricata (Windows service installation; src/win32-service.c)to a version that resolves this vulnerability.Fixed in 7.0.17 - Upgrade
Upgrade
Suricata (Windows service installation; src/win32-service.c)to a version that resolves this vulnerability.Fixed in 8.0.6
Event History
Frequently Asked Questions
Which installations are actually exposed to exploitation?
Affected installations are those running Suricata before 7.0.17 or 8.0.6 on Windows, installed under a path containing spaces, where an earlier component of that path is writable by a local low-privileged attacker.
What access does an attacker need?
The attacker needs local low-privileged access and write access to an earlier component of Suricata's installation path. Exploitation does not require user interaction and can result in code execution as LocalSystem.
Are all default Windows installations affected?
No. Exploitation depends on the service ImagePath being unquoted, Suricata being installed in a path with spaces, and an earlier path component being writable by a low-privileged local user.
What is the remediation?
Upgrade Suricata to version 7.0.17 or 8.0.6, which fix the Windows service installation and parameter-update handling.