CVE-2022-50918: VIVE Runtime Service Privilege Escalation

CVE-2022-50918 Overview

CVE-2022-50918 is an unquoted service path vulnerability affecting VIVE Runtime Service version 1.0.0.4. This privilege escalation flaw allows local users to execute arbitrary code with elevated system privileges by exploiting the improper handling of the service binary path. Attackers can place malicious executables in specific system directories, which are then executed with LocalSystem privileges when the vulnerable service starts.

Critical Impact

Local attackers with limited privileges can achieve LocalSystem access, enabling complete system compromise, persistence, and lateral movement within affected environments.

Affected Products

• VIVE Runtime Service 1.0.0.4
• HTC VIVE VR Software Suite containing vulnerable ViveAgentService
• Systems with VIVE Runtime Service installed in default paths with spaces

Discovery Timeline

• 2026-01-13 - CVE CVE-2022-50918 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2022-50918

Vulnerability Analysis

The vulnerability exists due to an unquoted service path in the VIVE Runtime Service (ViveAgentService). When Windows services are configured with executable paths containing spaces that are not enclosed in quotation marks, the operating system attempts to parse the path ambiguously. This parsing behavior allows an attacker to place a strategically named executable in a location that Windows will execute before reaching the intended service binary.

For example, if the service path is configured as C:\Program Files\HTC\VIVE\Runtime\Service.exe, Windows will attempt to execute files in the following order: C:\Program.exe, C:\Program Files\HTC\VIVE\Runtime\Service.exe. An attacker with write access to C:\ can place a malicious Program.exe that will be executed with the service's privileges—typically LocalSystem.

Root Cause

The root cause is classified as CWE-428 (Unquoted Search Path or Element). The VIVE Runtime Service installer failed to properly quote the service binary path during registration with the Windows Service Control Manager. This configuration oversight leaves the service vulnerable to path interception attacks when the installation path contains spaces.

Attack Vector

The attack requires local access to the system with sufficient privileges to write files to directories that appear in the unquoted path resolution order. The attacker creates a malicious executable with a name that matches an intermediate path segment (such as Program.exe in C:\ or other writable locations along the path). When the VIVE Runtime Service is started or restarted, Windows executes the attacker's malicious binary with LocalSystem privileges, providing complete system access.

The vulnerability is exploitable through local access vectors with low attack complexity and requires low privileges. No user interaction is necessary for exploitation once the malicious executable is positioned.

Detection Methods for CVE-2022-50918

Indicators of Compromise

• Unexpected executable files named Program.exe, HTC.exe, or similar in root directories like C:\ or C:\Program Files\
• Anomalous process spawning from service contexts, particularly children of services.exe with unusual binaries
• Service startup failures or unexpected behavior from VIVE Runtime Service
• Evidence of privilege escalation attempts in Windows Security Event logs

Detection Strategies

• Query Windows services for unquoted paths using PowerShell: Get-WmiObject win32_service | Where-Object {$_.PathName -notlike '"*"*' -and $_.PathName -like '* *'}
• Monitor file system changes in root directories and common interception points for new executable files
• Implement application whitelisting to block execution of unauthorized binaries in system directories
• Use endpoint detection and response (EDR) solutions to identify service-based privilege escalation attempts

Monitoring Recommendations

• Enable Windows Security Event logging for service installation and modification (Event IDs 4697, 7045)
• Configure file integrity monitoring on directories within service paths containing spaces
• Establish baseline of legitimate services and alert on new service registrations with unquoted paths
• Monitor for process creation events where parent process is a service and child binary is in an unexpected location

How to Mitigate CVE-2022-50918

Immediate Actions Required

• Audit all installed services for unquoted paths using wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """
• Manually quote the service path in the Windows Registry under HKLM\SYSTEM\CurrentControlSet\Services\ViveAgentService
• Remove any suspicious executables from directories that could be used for path interception
• Restrict write permissions on root directories and C:\Program Files to administrators only
• Consider disabling the VIVE Runtime Service if not actively required

Patch Information

Users should check the Vive Developer Resources for updated software versions that address this vulnerability. For detailed technical information, refer to the VulnCheck Advisory for Vive Agent Service. Additional exploit details are documented in Exploit-DB #50824.

Workarounds

• Manually fix the unquoted path by modifying the registry key HKLM\SYSTEM\CurrentControlSet\Services\ViveAgentService\ImagePath to include quotation marks around the path
• Implement application control policies to prevent execution of binaries from non-standard locations
• Use NTFS permissions to restrict write access to directories that appear in the service path resolution order
• Deploy Group Policy settings to audit and remediate unquoted service paths across the environment

# Registry fix example - Run as Administrator in PowerShell
# First, verify the current unquoted path
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\ViveAgentService" -Name ImagePath

# Apply the quoted path fix
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\ViveAgentService" -Name ImagePath -Value '"C:\Program Files\HTC\VIVE\Runtime\ViveAgentService.exe"'

# Verify the fix was applied
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\ViveAgentService" -Name ImagePath