CVE-2022-50917: 
Homebrew vulnerability analysis and mitigation

CVE-2022-50917 is an unquoted service path vulnerability (CWE-428) in ProtonVPN version 1.26.0 for Windows, specifically affecting its WireGuard service configuration. The flaw allows local attackers with low privileges to potentially execute arbitrary code with elevated privileges during service startup. The CVE was received from VulnCheck on January 13, 2026, and published by NVD on the same date, with last modification on March 2, 2026. It carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 8.5 (High) (VulnCheck Advisory, Red Hat CVE).

The vulnerability is classified as CWE-428 (Unquoted Search Path or Element) and stems from the WireGuard service configuration in ProtonVPN 1.26.0 on Windows using an unquoted executable path. When Windows attempts to resolve an unquoted service path containing spaces, it searches for executables at each space-delimited path segment before reaching the intended binary. A local attacker with low privileges can place a malicious executable at a predictable intermediate path location (e.g., C:\Program.exe or C:\Program Files\ProtonVPN.exe) so that it is executed instead of the legitimate service binary when the WireGuard service starts. No user interaction is required, and the attack complexity is low (VulnCheck Advisory, Exploit-DB).

Successful exploitation allows a local attacker to execute arbitrary code in the security context of the WireGuard service, which typically runs with elevated (SYSTEM-level) privileges on Windows. This results in high impact to confidentiality, integrity, and availability — an attacker could read sensitive data, modify or delete files, and disrupt system functionality. The attack can be triggered automatically upon service restart or system reboot without any user interaction, enabling persistent privilege escalation (VulnCheck Advisory, Red Hat CVE).

A public proof-of-concept exploit is available on Exploit-DB (EDB-50837), submitted and referenced by VulnCheck (Exploit-DB). There is no current evidence of in-the-wild exploitation or known threat actor attribution. The EPSS score is approximately 0.012% (0.000120), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the time of this report.

1. Reconnaissance: Identify systems running ProtonVPN 1.26.0 on Windows. Confirm the WireGuard service is installed and its service path is unquoted using sc qc <ServiceName> or by inspecting the registry key HKLM\SYSTEM\CurrentControlSet\Services\<WireGuardServiceName>.
2. Identify vulnerable path segments: Parse the unquoted service path (e.g., C:\Program Files\Proton\ProtonVPN\...\wireguard.exe) to identify all space-delimited intermediate locations Windows will attempt to resolve (e.g., C:\Program.exe, C:\Program Files\Proton.exe).
3. Place malicious executable: With low-privilege local access, write a malicious executable (e.g., a reverse shell or privilege escalation payload) to one of the intermediate path locations that the attacker has write access to.
4. Trigger service restart: Wait for or trigger a service restart (e.g., system reboot, manual service restart if permitted) so that Windows resolves the unquoted path and executes the malicious binary instead of the legitimate WireGuard service binary.
5. Achieve elevated code execution: The malicious executable runs in the context of the service account (typically SYSTEM), granting the attacker full control of the system (Exploit-DB, VulnCheck Advisory).

• Registry: Inspect HKLM\SYSTEM\CurrentControlSet\Services\ for ProtonVPN/WireGuard service entries with unquoted ImagePath values containing spaces.
• File System: Unexpected executables placed at intermediate path locations such as C:\Program.exe, C:\Program Files\Proton.exe, or similar space-delimited segments of the WireGuard service path; unauthorized modifications to files in the ProtonVPN installation directory.
• Process: Unusual processes spawned by the WireGuard service (e.g., cmd.exe, powershell.exe, or unknown binaries) with a parent process matching the service host.
• Logs: Windows Event Log entries (Event ID 7036 or 7045) showing unexpected service state changes or new service installations; Security event logs showing privilege escalation or new process creation under the SYSTEM account originating from the ProtonVPN service path.

No official patch from Proton has been confirmed for version 1.26.0 at the time of this report. Recommended mitigations include: (1) upgrading ProtonVPN to a version beyond 1.26.0 if available and confirmed to fix the unquoted path; (2) restricting write access to directories in the WireGuard service path to prevent untrusted users from placing malicious executables; (3) disabling or uninstalling ProtonVPN 1.26.0 if it is not operationally critical; (4) implementing file integrity monitoring on the WireGuard service configuration and related directories; and (5) monitoring for suspicious executables in common service path locations (VulnCheck Advisory, Red Hat CVE).

The vulnerability was reported and assigned by VulnCheck, which published a dedicated advisory. Red Hat has also tracked the CVE in its security database. No significant public researcher commentary, social media discussion, or major media coverage has been identified for this vulnerability beyond the initial disclosure.