QID 983071

Security update has been released for PyInstaller to fix the vulnerability.

Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.

Local Privilege Escalation in all Windows software frozen by PyInstaller in "onefile" mode.

The vulnerability is present only on Windows and in this particular case: If a **software frozen by PyInstaller in "onefile" mode** is launched by a (privileged) user who has **his/her "TempPath" resolving to a world writable directory**. This is the case e.g. if the software is launched as a service or as a scheduled task using a system account (in which case TempPath will default to C:\Windows\Temp).

In order to be exploitable the software has to be (re)started after the attacker has launched the exploit program. So for a service launched at startup, a service restart is needed (e.g. after a crash or an upgrade).

While PyInstaller itself was not vulnerable, all Windows software frozen by PyInstaller in "onefile" mode is vulnerable.

CVSSv3 score 7.0 (High)
CVSSv3 vector CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected
- all Windows software frozen by PyInstaller in "onefile" mode

No affected
- PyInstaller itself (except if frozen by PyInstaller in "onefile" mode on Windows)
- software frozen in "one*dir*" mode
- other platforms (GNU/Linux, OS X, BSD, etc.)