Loading story…
Newly documented vulnerabilities in Spy Emergency build 23.0.205 and sheed AntiVirus 2.3 allow local attackers to escalate privileges to LocalSystem through unquoted service path flaws classified as CWE-428. The affected services are SpyEmrgHealth and SpyEmrgSrv in Spy Emergency, and ShavProt in sheed AntiVirus. In each case, a low-privileged user can place a malicious executable in a path segment that Windows may incorrectly parse because the service executable path is not enclosed in quotes.
If the vulnerable service is restarted or the host is rebooted, Windows can execute the attacker-controlled binary with SYSTEM-level privileges, creating a high-impact local privilege escalation path affecting confidentiality, integrity, and availability. The issues are tracked as CVE-2016-20056 for Spy Emergency and CVE-2016-20061 for sheed AntiVirus, with both records referencing vendor resources, Exploit-DB, and VulnCheck advisories.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
A CVE entry documented a local privilege escalation vulnerability in sheed AntiVirus 2.3 involving an unquoted service path in the ShavProt service. A local attacker can exploit the issue by placing a malicious binary in the unquoted path and triggering a service restart or reboot to execute code as LocalSystem.
A CVE entry documented an unquoted service path privilege escalation vulnerability in Spy Emergency build 23.0.205 affecting the SpyEmrgHealth and SpyEmrgSrv services. The flaw allows a low-privileged local attacker to place a malicious executable in the service path and gain LocalSystem privileges when the service restarts or the system reboots.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Newly published CVEs detail **unquoted service path** vulnerabilities in two IObit products that can let a low-privileged local attacker gain **`LocalSystem`** execution. **CVE-2016-20055** affects **IObit Advanced SystemCare 10.0.2**, specifically the `AdvancedSystemCareService10` service, while **CVE-2016-20059** affects **IObit Malware Fighter 4.3.1** through the `IMFservice` and `LiveUpdateSvc` services. Both issues are classified as **CWE-428** and carry high-severity CVSS v3.1 and v4.0 ratings reflecting potential impact to confidentiality, integrity, and availability. In both cases, an attacker with local access can place a malicious executable in a vulnerable service path and wait for the affected service to restart or for the system to reboot, at which point the payload may run with elevated privileges. The Malware Fighter entry cites supporting references including IObit product pages, an **Exploit-DB** listing, and a **VulnCheck** advisory, while both CVEs were recorded through disclosures submitted to **disclosure@vulncheck.com**.
Jun 29, 2026
**Small HTTP Server 3.06.36** by Smallsrv contains high-severity Windows service path vulnerabilities tracked as **`CVE-2025-41368`** and **`CVE-2025-41359`**. Both advisories describe an **unquoted service path** affecting the executable configuration `C:\Program Files (x86)\shttps_mg\http.exe service`, which can cause Windows to resolve and launch an attacker-controlled executable from a higher-priority path location instead of the intended service binary. A successful attack requires local access but could lead to **arbitrary code execution**, **unauthorized system access**, or **service disruption** if a malicious file is planted in the path searched by the service. The published mitigations call for properly quoting the Windows service path, applying available security updates, and restricting physical and network access to affected systems.
Jun 29, 2026
A high-severity local privilege escalation flaw tracked as **`CVE-2025-71326`** affects **AVAST Antivirus 25.11** on Windows, allowing a non-privileged local user to potentially execute arbitrary code with **SYSTEM** privileges. The vulnerability stems from an **unquoted service path** in the Avast SecureLine service, `SecureLine`, where the binary path points to `C:\Program Files\AVAST Software\SecureLine\VpnSvc.exe`, creating an opportunity for path hijacking during service execution. The issue was previously documented in a verified **Exploit-DB** entry authored by Milad Karimi (**Ex3ptionaL**) and has now been assigned a CVE and high severity ratings, including **CVSS 4.0 8.5** and **CVSS 3.1 7.8**. Although the flaw is not remotely exploitable and requires local access, successful exploitation could significantly affect confidentiality, integrity, and availability. Recommended mitigation includes quoting the service path, removing unnecessary spaces where possible, and applying vendor fixes or updates when available.
Jun 29, 2026