CVE-2026-57223: Suricata Windows Privilege Escalation

CVE-2026-57223 Overview

CVE-2026-57223 is a local privilege escalation vulnerability in Suricata, the open-source network Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and Network Security Monitoring engine maintained by the Open Information Security Foundation (OISF). The flaw resides in the Windows service installation and parameter-update logic within src/win32-service.c, which passes an unquoted service ImagePath to CreateServiceA. When Suricata is installed under a path containing spaces and an earlier writable path component exists, a low-privileged local attacker can plant a binary that Windows will execute as LocalSystem. The issue is classified as an unquoted search path or element weakness [CWE-428] and is fixed in Suricata 7.0.17 and 8.0.6.

Critical Impact
A local low-privileged user can escalate to LocalSystem by placing an attacker-controlled executable in a writable directory that precedes the Suricata binary in an unquoted service path.

Affected Products

Suricata for Windows versions prior to 7.0.17 (7.x branch)
Suricata for Windows versions prior to 8.0.6 (8.x branch)
Windows installations where the Suricata service path contains spaces and a preceding directory is writable by low-privileged users

Discovery Timeline

2026-09-18 - CVE-2026-57223 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-57223

Vulnerability Analysis

The vulnerability is an unquoted service path issue in Suricata's Windows service registration logic. When Suricata is installed with --service-install, the code in src/win32-service.c constructs the service binary path using GetModuleFileName and appends command-line arguments separated by spaces. This constructed string is then supplied to CreateServiceA as the lpBinaryPathName. Because the path is not wrapped in quotation marks, Windows applies its documented behavior of splitting the path at each space and attempting to execute each candidate executable in turn.

If Suricata is installed under a directory such as C:\Program Files\Suricata Software\suricata.exe, Windows will search for C:\Program.exe, then C:\Program Files\Suricata.exe, before reaching the intended binary. The service runs as LocalSystem, so any planted executable that Windows chooses to launch inherits SYSTEM privileges.

Root Cause

The root cause is missing quotation around the service ImagePath string when it is passed to Windows service management APIs. The pre-patch code initialized path and populated it directly from GetModuleFileName, then appended arguments without ever wrapping the executable path in double quotes. This violates the Windows service registration guidance for paths containing spaces and maps directly to [CWE-428].

Attack Vector

Exploitation requires local access with low privileges and a Suricata installation located below a path that both contains spaces and has an earlier path component writable by the attacker. The attacker places a malicious executable at the hijack location (for example C:\Program.exe) and waits for the Suricata service to start or restart. Windows then launches the attacker's binary as LocalSystem, completing the privilege escalation.

     do {
         memset(path, 0, sizeof(path));
 
-        if (GetModuleFileName(NULL, path, MAX_PATH) == 0 ){
+        path[0] = '"';
+        if (GetModuleFileName(NULL, path + 1, sizeof(path) - 1) == 0) {
             SCLogError("Can't get path to service binary: %d", (int)GetLastError());
             break;
         }
+        if (strlcat(path, "\"", sizeof(path)) >= sizeof(path)) {
+            SCLogError("failed to construct service path string: path truncated: %s", path);
+            break;
+        }
 
         /* skip name of binary itself */
         for (i = 1; i < argc; i++) {
             if ((strlen(argv[i]) <= strlen("--service-install")) && (strncmp("--service-install", argv[i], strlen(argv[i])) == 0)) {
                 continue;
             }
-            strlcat(path, " ", sizeof(path) - strlen(path) - 1);
-            strlcat(path, argv[i], sizeof(path) - strlen(path) - 1);
+            if (strlcat(path, " ", sizeof(path)) >= sizeof(path)) {
+                SCLogError("failed to construct service path string: path truncated: %s", path);
+                return -1;
+            }
+            if (strlcat(path, argv[i], sizeof(path)) >= sizeof(path)) {
+                SCLogError("failed to construct service path string: path truncated: %s", path);
+                return -1;
+            }
         }

Source: GitHub Commit 0dad38f (OISF/suricata). The patch wraps the executable path in double quotes before appending arguments, ensuring Windows treats the full path as a single token.

Detection Methods for CVE-2026-57223

Indicators of Compromise

Unexpected executable files such as Program.exe at the root of a drive, or partial-name executables inside directories that appear along the Suricata service path.
Suricata service ImagePath registry value under HKLM\SYSTEM\CurrentControlSet\Services\Suricata that lacks surrounding double quotes and contains spaces.
Windows Event Log entries showing the Suricata service starting a process from a directory other than the installation directory.

Detection Strategies

Enumerate all Windows services and flag any whose ImagePath contains spaces without quotation marks using wmic service get name,pathname,startmode or a PowerShell equivalent.
Alert on new executables written into directories that sit above installed service binaries, especially when the writer is a non-administrative account.
Correlate service start events (Event ID 7036) with process creation events (Event ID 4688) where the parent is services.exe and the child image path does not match the registered service binary.

Monitoring Recommendations

Monitor filesystem writes to C:\, C:\Program Files\, and other parent directories of service binaries by non-administrator users.
Audit registry modifications to HKLM\SYSTEM\CurrentControlSet\Services\Suricata\ImagePath for changes that remove or alter quoting.
Track process lineage where services.exe spawns processes running as NT AUTHORITY\SYSTEM from unusual paths.

How to Mitigate CVE-2026-57223

Immediate Actions Required

Upgrade Suricata for Windows to version 7.0.17 or 8.0.6, then reinstall or re-register the service so the corrected quoted ImagePath is written to the registry.
Audit the ImagePath value for the Suricata service and manually add surrounding double quotes if upgrading is not immediately feasible.
Review and tighten directory access control lists (ACLs) on every parent directory of the Suricata service binary to remove write permissions for non-administrative principals.

Patch Information

The fix is available in Suricata 7.0.17 and Suricata 8.0.6. The corresponding patches are tracked in commits 0dad38f, 2b924d4, and ac1b3cc, delivered via Pull Request #15676. Additional context is available in GHSA-jh8w-wf3f-58jp and OISF Issue #8600.

Workarounds

Reinstall Suricata into a path that contains no spaces, such as C:\Suricata\, to eliminate the hijack surface.
Manually edit the service ImagePath registry value to wrap the executable path in double quotes and restart the service.
Restrict write permissions on all parent directories of the service binary so low-privileged users cannot plant executables along the search path.

bash

# Query the current Suricata service ImagePath and validate quoting
sc.exe qc Suricata

# Correct the ImagePath to a fully quoted string (run as Administrator)
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Suricata" /v ImagePath /t REG_EXPAND_SZ /d "\"C:\Program Files\Suricata\suricata.exe\" --service" /f

# Restart the service to apply the change
sc.exe stop Suricata && sc.exe start Suricata