Skip to content
OpenAdvisories
Medium · 5.8 CVE-2025-12683 EUVD-2025-37585GHSA-m6v3-xvp5-5g2q

NULL DACL assigned to Named Pipe communicating with SYSTEM Service

Published Nov 4, 2025 · Updated Nov 4, 2025 · Assigned by Gridware

Description

The service employed by Everything, running as SYSTEM, communicates with the lower privileged Everything GUI via a named pipe. The named pipe has a NULL DACL and thus provides all users full permission over it; leading to potential Service Denial Of Service or Privilege escalation(only if chained with other elements) for a local low privilege user.

Affected products

VendorProductAffectedFixed
Voidtools Everything =<1.4.1.1029 —

References