Winstep Xtreme Service in version 18.06.0096 registers a service path without quotation marks, enabling a local attacker to place a malicious executable in the Program Files directory. When the service starts, the unquoted path causes the executable to run with LocalSystem privileges, allowing the attacker to gain full system access, modify files, and execute arbitrary code without detection.

The vulnerability affects the Winstep product (Winstep Xtreme Service) released as version 18.06.0096. Any installation of this specific release is vulnerable.

The CVSS score of 8.5 indicates a high severity risk. The EPSS score is not available, so the current exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, suggesting no large‑scale public exploitation has been reported. The attack vector is local: an attacker who can write to the Program Files directory or otherwise specify a path can trigger the privilege escalation during the service startup.