CVE-2020-36957: PDF Complete Privilege Escalation Flaw

CVE-2020-36957 Overview

PDF Complete 3.5.310.2002 contains an unquoted service path vulnerability in its pdfsvc.exe service configuration. This local privilege escalation vulnerability allows attackers to exploit the unquoted path to inject and execute malicious code with elevated LocalSystem privileges. The vulnerability is classified as CWE-428 (Unquoted Search Path or Element), a well-known Windows service misconfiguration that can lead to arbitrary code execution.

Critical Impact

Local attackers with low privileges can potentially achieve LocalSystem privilege escalation by placing a malicious executable in a path that Windows will execute before the intended service binary.

Affected Products

• PDF Complete 3.5.310.2002
• PDF Complete pdfsvc.exe service component

Discovery Timeline

• 2026-01-26 - CVE CVE-2020-36957 published to NVD
• 2026-01-27 - Last updated in NVD database

Technical Details for CVE-2020-36957

Vulnerability Analysis

This vulnerability exists due to improper quoting of the service executable path in the Windows registry configuration for PDF Complete's pdfsvc.exe service. When a Windows service path contains spaces and is not enclosed in quotation marks, Windows will attempt to execute binaries in a predictable sequence based on space-delimited path segments.

For example, if the service path is configured as C:\Program Files\PDF Complete\pdfsvc.exe without quotes, Windows will first attempt to execute C:\Program.exe, then C:\Program Files\PDF.exe, before finally reaching the intended executable. An attacker with write access to any of these intermediate directories can place a malicious executable that will be executed with the service's privileges—in this case, LocalSystem.

Root Cause

The root cause is the improper configuration of the ImagePath registry value for the PDF Complete service. The service path is stored without quotation marks in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pdfsvc, allowing the Windows Service Control Manager to misinterpret the intended executable location when spaces exist in the path.

Attack Vector

This is a local attack vector requiring the attacker to have local access to the target system with sufficient privileges to write to one of the intermediate path directories. The attack scenario involves:

1. Identifying the unquoted service path through registry enumeration
2. Determining writable directories within the path hierarchy
3. Placing a malicious executable (e.g., Program.exe or PDF.exe) in the appropriate location
4. Waiting for the service to restart or manually triggering a service restart
5. The malicious executable runs with LocalSystem privileges

The vulnerability can be identified by querying Windows services for unquoted paths containing spaces. Technical details and proof-of-concept information are available through the Exploit-DB #49226 advisory and the VulnCheck Advisory.

Detection Methods for CVE-2020-36957

Indicators of Compromise

• Presence of unexpected executables named Program.exe, PDF.exe, or similar in C:\ or C:\Program Files\ directories
• Service configuration changes to the PDF Complete service registry keys
• Unexpected processes running with LocalSystem privileges
• Modified timestamps on service-related directories

Detection Strategies

• Enumerate all Windows services for unquoted paths using PowerShell: Get-WmiObject win32_service | Where-Object { $_.PathName -notlike '"*' -and $_.PathName -like '* *' }
• Monitor for file creation events in root directories and C:\Program Files\ with executable extensions
• Implement application whitelisting to prevent unauthorized executables from running
• Use endpoint detection and response (EDR) solutions to identify suspicious service behavior

Monitoring Recommendations

• Enable Windows Security Event logging for service configuration changes (Event ID 7040, 7045)
• Monitor process creation events for unexpected executables running as SYSTEM
• Implement file integrity monitoring on directories commonly exploited by unquoted service path attacks
• Configure alerts for new executable files created in C:\ and first-level subdirectories

How to Mitigate CVE-2020-36957

Immediate Actions Required

• Audit all installed services for unquoted paths using automated scripts or vulnerability scanners
• Manually correct the registry entry for the PDF Complete service by adding quotation marks around the ImagePath value
• Consider removing PDF Complete if it is not essential to business operations
• Restrict write permissions to C:\ and C:\Program Files\ directories

Patch Information

No official patch information is available from the vendor at this time. Users should consult the PDF Complete product information for potential updates or contact the vendor directly. In the absence of an official fix, manual remediation of the registry entry is recommended.

Workarounds

• Manually fix the unquoted service path by modifying the registry: Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pdfsvc and enclose the ImagePath value in quotation marks
• Implement application control policies to prevent execution of unsigned binaries in commonly exploited directories
• Use Group Policy to restrict write access to vulnerable path locations
• Consider deploying SentinelOne or similar EDR solutions to detect and block exploitation attempts

# Registry fix example using reg.exe (run as Administrator)
# First, query the current service path
reg query "HKLM\SYSTEM\CurrentControlSet\Services\pdfsvc" /v ImagePath

# Then update with quoted path (adjust path as needed for your installation)
reg add "HKLM\SYSTEM\CurrentControlSet\Services\pdfsvc" /v ImagePath /t REG_EXPAND_SZ /d "\"C:\Program Files\PDF Complete\pdfsvc.exe\"" /f