CVE-2020-36957
Published: 26 January 2026
Summary
CVE-2020-36957 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Informer (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 2.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2020-36957 is an unquoted service path vulnerability (CWE-428) affecting PDF Complete version 3.5.310.2002, specifically in the configuration of its pdfsvc.exe Windows service. This flaw allows the service executable path to be unquoted, enabling attackers to hijack the service execution by placing malicious files in intermediate directories along the search path. The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for privilege escalation.
Local attackers with low-privilege user accounts (PR:L) can exploit this vulnerability with low complexity and no user interaction required. By creating a malicious executable in a writable directory that the system searches before the legitimate pdfsvc.exe path, the attacker can cause the service to execute their code instead. Successful exploitation grants LocalSystem privileges, allowing full control over the affected system, including high-impact confidentiality, integrity, and availability violations.
Advisories, including those from VulnCheck at https://www.vulncheck.com/advisories/pdf-complete-pdfsvcexe-unquoted-service-path, document the issue in pdfsvc.exe. An exploit is publicly available on Exploit-DB at https://www.exploit-db.com/exploits/49226, confirming practical exploitability. Additional details on the affected software are at https://pdf-complete.informer.com/3.5/. No patches are specified in available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30851
Vulnerability details
PDF Complete 3.5.310.2002 contains an unquoted service path vulnerability in its pdfsvc.exe service configuration. Attackers can exploit the unquoted path to inject and execute malicious code with elevated LocalSystem privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path in pdfsvc.exe directly enables path interception for service hijacking (T1574.009) leading to privilege escalation to LocalSystem (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires establishing and enforcing secure configuration settings for Windows services, including properly quoting executable paths to prevent hijacking via unquoted service path vulnerabilities like CVE-2020-36957.
Directs timely identification, reporting, and correction of flaws such as the unquoted service path in pdfsvc.exe, mitigating the privilege escalation risk.
Enforces least privilege for services like pdfsvc.exe, reducing the impact of hijacking by preventing execution with unnecessary LocalSystem privileges.