CVE-2026-57223 in Suricata
Summary
by MITRE • 09/18/2026
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the Windows service installation and parameter-update logic in src/win32-service.c can pass an unquoted service ImagePath to CreateServiceA. When Suricata is installed below a path containing spaces and an earlier path component is writable by a local low-privileged attacker, Windows can execute an attacker-controlled program as LocalSystem, resulting in local privilege escalation. This issue is fixed in versions 8.0.6 and 7.0.17.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified involves the Suricata network security engine on Microsoft Windows operating systems, specifically affecting service installation and parameter update logic within the source file src/win32-service.c prior to version 7.0.17 and 8.0.6. This flaw stems from an improper handling of command line arguments when registering or updating a Windows service using the CreateServiceA API function. The core technical deficiency is the failure to properly quote the ImagePath parameter provided during these operations. In Windows, if a file path contains spaces and is not enclosed in quotation marks, the operating system's parser interprets each space-separated segment as a distinct argument rather than part of a single executable path. This behavior creates an unquoted service path vulnerability, which is widely recognized under CWE-436: Interpretation Error.
The operational impact of this flaw is severe because it enables local privilege escalation to the LocalSystem account, which possesses unrestricted access to all resources on the system and can perform any action that a user with administrator privileges can perform. For an attacker to exploit this condition, two specific environmental prerequisites must be met simultaneously. First, Suricata must be installed in a directory path that includes spaces, such as C:\Program Files\Suricata. Second, there must exist at least one earlier component of the installation path that is writable by a local low-privileged user account. For instance, if the full path is C:\My Folder\Suricata and the attacker has write permissions to C:\ or any intermediate directory like My, they can leverage this misconfiguration.
When an unquoted service path vulnerability exists, Windows attempts to execute executables located in each segment of the path before reaching the actual intended executable. In a scenario where the first component is writable by an attacker, such as placing a malicious executable named Suricata.exe or Program.exe in C:\, the system will inadvertently load and execute this malicious binary with LocalSystem privileges during service startup or configuration updates. This mechanism allows low-privileged users to achieve arbitrary code execution at the highest privilege level on the host machine without requiring any additional authentication or social engineering tactics beyond gaining local user access.
This vulnerability aligns closely with MITRE ATT&CK technique T1543.002, which describes creating a new service as a method for persistence and privilege escalation. By manipulating the service configuration through the vulnerable logic in Suricata, an attacker effectively hijacks the system's trust mechanism to execute code under the context of LocalSystem. The risk is particularly acute in environments where multiple applications share common installation directories or where default permissions allow standard users to write to root-level folders like C:\Program Files subdirectories if not properly secured by Group Policy Objects or discretionary access control lists.
Mitigation strategies primarily involve upgrading Suricata to version 7.0.17 or later, which includes the necessary code changes to ensure that service paths are correctly quoted before being passed to Windows API functions. This prevents the operating system from misinterpreting spaces in file paths as argument delimiters. Additionally, administrators should enforce strict permission controls on installation directories to prevent low-privileged users from writing executables into any component of the path leading up to the Suricata binary. Regular auditing of service configurations and adherence to least privilege principles for application installations further reduce the attack surface associated with unquoted service paths across all Windows-based security tools.