MacroHub, a utility from GIGABYTE, contains a local privilege escalation flaw that occurs when the application launches external programs with improper privilege handling. An authenticated user on the same machine can trigger this behavior to run arbitrary code with SYSTEM privileges, effectively gaining full control and the ability to modify or delete any file, install software, or disrupt services.

All installations of GIGABYTE MacroHub with versions earlier than 2.3.2 are affected. The vulnerability exists in the base application regardless of the operating system version, as the flaw originates from the MacroHub executable itself.

The vulnerability scores an 8.5 on the CVSS scale, indicating a high severity, while the EPSS score is below 1%, suggesting a low but non-zero exploitation probability at the time of this analysis. It is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is inferred to be a local authenticated user; an attacker would need local access to the victim’s machine to manipulate MacroHub or its external application launching behavior. If exploited, the attacker achieves full system privileges, potentially leading to data compromise, ransomware installation, or other destructive actions.