Kite 4.2.0.1 U1 contains an unquoted service path in the Windows service that can be manipulated by a local user. When the service starts, the system attempts to execute the binary in the Program Files directory without surrounding quotes, allowing a malicious executable with the same name to run with LocalSystem privileges. This flaw provides a local privilege escalation capability and could be used to take control of the affected machine. The weakness is identified as a CWE‑428 unquoted service path issue.

The vulnerability affects the Kite software product from Kite. All installations utilizing the KiteService on a Windows machine with a service binary path residing in the default Program Files directory are susceptible. No specific version list is provided beyond the mention of 4.2.0.1 U1; therefore any deployment of that release should be reviewed.

The CVSS score of 8.5 indicates a high severity impact. The issue is not listed in the CISA KEV catalog. Attackers would require local access and the ability to place a file in the Program Files folder or modify the service path. Once the malicious binary runs with LocalSystem privileges when the service starts, the attacker can fully compromise the host.