The Hotspot Shield 6.0.3 installation contains an unquoted service path flaw in its hshld service binary. When the service path is not surrounded by quotation marks, the Windows service launcher can misinterpret the location of the executable and will execute any file placed in that directory. Local attackers can therefore deploy a malicious executable in the service folder and, upon service restart or a system reboot, the code runs with LocalSystem privileges. This elevation grants full control over the machine, allowing an attacker to modify files, install additional software, or exfiltrate data.

Hotspot Shield version 6.0.3 is affected. The vulnerability is tied to the hshld Windows service that ships with this specific build. No other versions are listed as affected in the CNA data.

The CVSS score of 8.5 indicates a high severity risk. The attack can only be carried out by a local user who can place an executable in the service directory; no remote exploitation vector is described. Because the EPSS score is not available and the issue is not listed in the KEV catalog, the overall likelihood of public exploitation is unknown, but local privilege escalation remains a serious threat if the vulnerability is left unpatched.