Privacy Drive 3.17.0 contains an unquoted service path vulnerability that lets a local attacker execute arbitrary code with LocalSystem privileges. By placing a malicious executable in the directory referenced by the service startup process, an attacker can cause the executable to run during service startup or a system reboot. This elevates an attacker’s privileges, allowing full control over the affected machine and potentially compromising confidentiality, integrity, and availability of data on that system.

The vulnerability affects the Cybertronsoft Privacy Drive product, specifically version 3.17.0, where the pdsvc.exe service binary is configured with an unquoted path. No other products or versions are listed as affected.

The CVSS score of 8.5 indicates a high severity risk. The EPSS score is not available, but the flaw has been demonstrated in the wild through exploit‑db and other advisory sites. It is not listed in the CISA KEV catalog. The likely attack vector is a local attacker who can write to the service path directories or otherwise gain local access to the system, then place a malicious binary there. Once the system starts the pdsvc service or reboots, the malicious code runs with LocalSystem privileges, giving the attacker full control of the system.