GALACTICAL BUG HUNTING: HOW WE DISCOVERED NEW ISSUES IN CD PROJEKT RED’S GAMING PLATFORM

Summary from the TLDR InfoSec newsletter

This technical blog post details the vulnerabilities and exploits that led to the discovery of issues in CD Projekt Red's GOG Galaxy 2.0 gaming platform related to Denial-of-Service and Local Privilege Escalation (assigned CVE IDs 2023-50915 and 2023-50914). It highlights the risks associated with insecure interactions within the platform. The vulnerabilities involve inter-process communication and filesystem manipulation and can lead to potential exploitation for impactful attacks.