---
id: 8935
canonical_url: "https://phying.com/item/8935"
title: "GOG Galaxy Local Privilege Escalation (LPE) PoC via DLL Search-Order Hijacking"
type: "vulnerability"
cve: null
cvss: null
severity: "high"
vendor: "GOG.com"
product: "GOG Galaxy"
affected_versions: "GalaxyCommunication.exe 2.0.6.28"
source_domain: "github.com"
source_url: "https://github.com/0xv1n/gog-lpe-poc"
published_at: "2026-10-02T16:53:22Z"
snapshot_at: "2026-10-26T05:50:00Z"
archived_by: "Phying News (https://phying.com/item/8935)"
lang: "en"
---

# GOG Galaxy Local Privilege Escalation PoC

*Author: 0xv1n · Source: [github.com/0xv1n/gog-lpe-poc](https://github.com/0xv1n/gog-lpe-poc)*

Proof of concept for a DLL search-order hijack in the GOG Galaxy `GalaxyCommunication` service. A local user who can write `IPHLPAPI.DLL` beside `GalaxyCommunication.exe` and start the service can execute code as `NT AUTHORITY\SYSTEM`.

## Demo

[![GOG Galaxy SYSTEM command prompt proof of concept](https://github.com/0xv1n/gog-lpe-poc/raw/main/demo.gif)](https://github.com/0xv1n/gog-lpe-poc/blob/main/demo.gif)

Tested with `GalaxyCommunication.exe` 2.0.6.28 on Windows 10 Pro 25H2.

## Build

Install the Visual Studio C++ x86 build tools, then run:

```cmd
.\build.cmd
```

## Run

From a non-elevated PowerShell session, run:

```powershell
.\run.ps1
```

The script deploys the DLL, starts the service, opens a SYSTEM command prompt, removes the DLL, and restores the original service state.

Use only on systems you own or are authorized to test.

---
> 📦 **Full-Text Markdown Snapshot** archived by [Phying News](https://phying.com/item/8935) · Original source: [github.com](https://github.com/0xv1n/gog-lpe-poc)