CVE-2026-57223: Suricata Unquoted Service Path on Windows

Overview

CVE-2026-57223 is a high-severity (CVSS 7.0) local privilege escalation flaw in Suricata, the open-source IDS/IPS/NSM engine, affecting Windows deployments only. The bug lives in src/win32-service.c: the routine that installs the Suricata Windows service — and the routine that later updates its parameters — builds the service ImagePath value passed to the Win32 CreateServiceA API without quoting it. NVD tracks it under CWE-428 (Unquoted Search Path or Element). It is fixed in Suricata 7.0.17 and 8.0.6.

Technical Details

How It Works

When the Windows Service Control Manager parses an unquoted path that contains spaces, it treats each space as a potential argument boundary and tries progressively longer prefixes as candidate executables. A service ImagePath of C:\Program Files\Suricata\suricata.exe -c suricata.yaml, if not wrapped in quotes, can resolve first to C:\Program.exe, then to C:\Program Files\Suricata\suricata.exe, in that order. If a local, low-privileged attacker can write an executable to any directory earlier in that unquoted chain — for example an unsecured C:\ root, or another writable ancestor of the install path — Windows launches the attacker's binary instead of Suricata the next time the service starts. Because the Suricata Windows service normally runs as LocalSystem, whatever the attacker planted executes with full SYSTEM privileges.

This is a well-understood vulnerability class and behaves like other unquoted-service-path bugs: it is strictly local, not remote. Exploitation requires an attacker who already has some code-execution or file-write foothold on the host, write access to a directory ahead of the real binary in the unquoted path, and a way to trigger a service (re)start. It cannot be triggered over the network and does not depend on Suricata processing any traffic.

Who Is at Risk

Organizations running Suricata's native Windows service build prior to 7.0.17 (7.x branch) or prior to 8.0.6 (8.x branch) are potentially affected, particularly where:

• Suricata is installed under a path containing spaces (the default C:\Program Files\Suricata\ qualifies)
• Permissions on C:\ or intermediate install-path folders are loosely configured
• The host is shared with other local users or lower-privileged service accounts

Linux and other Unix-like Suricata deployments are unaffected — the vulnerable code path is Windows-service-specific.

Mitigation

Immediate actions:

1. Upgrade to Suricata 7.0.17 or 8.0.6+ — both releases quote the ImagePath correctly.
2. If an immediate upgrade isn't possible, lock down write permissions on C:\ and every directory in the Suricata install path to Administrators/SYSTEM only.
3. As a stopgap, manually re-quote the existing service ImagePath in the registry (HKLM\SYSTEM\CurrentControlSet\Services\Suricata) so it reads "C:\Program Files\Suricata\suricata.exe" -c "suricata.yaml".

Detection guidance:

• Audit all Windows services for unquoted paths containing spaces — sc qc <service> or wmic service get name,pathname surfaces the raw ImagePath.
• Alert on unexpected executables appearing at path roots such as C:\Program.exe or C:\Program Files\Program.exe.
• Review Windows Event ID 7045 (new service installed) and 4657 (registry value modified) for unexpected changes to service ImagePath values.

References

• NVD — CVE-2026-57223
• Suricata
• Suricata 8.0.6 and 7.0.17 Released — Suricata Forum
• OISF/suricata PR #15670 — windows: always quote path for windows functions needing it
• Redmine #8600 — windows: unquoted LocalSystem service ImagePath