Wondershare PDFelement 5.2.9 contains a flaw in the WsAppService Windows service where the executable path is unquoted. Local attackers can exploit this by placing a malicious executable in the specified path; when the service restarts or the system reboots, the malicious code runs with LocalSystem privileges. This allows the attacker to gain full control over the affected machine, including the ability to install malware, exfiltrate data, or modify system settings.

The vulnerable product is Wondershare PDFelement version 5.2.9. No other affected versions are documented. Systems running this exact version on Windows are at risk.

The CVSS score of 8.5 indicates a high severity vulnerability. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, suggesting that while exploitation may not be widespread yet, its local nature and high privilege gain potential warrant immediate attention. Attackers must have local access to the system and sufficient permissions to place a file in the service path; they typically require an account that can modify the service configuration or drop files in the service directory. The high severity and local attack vector make this flaw a serious concern for environments where PDFelement 5.2.9 is deployed.