cve.bz

CAPEC-234

Hijacking a privileged process

Medium severityStandard pattern

An adversary gains control of a process that is assigned elevated privileges in order to execute arbitrary code with those privileges. Some processes are assigned elevated privileges on an operating system, usually through association with a particular user, group, or role. If an attacker can hijack this process, they will be able to assume its level of privilege in order to execute their own code.

On this page

Ask an AI about this attack pattern

ChatGPTClaudeGoogle AI Mode

Show the promptExplain the attack pattern CAPEC-234: Hijacking a privileged process: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/234.html and https://cve.bz/cve/capec/234?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.

How the attack unfolds

  1. Explore

    The attacker looks for a way in.

    1. [Find process with elevated priveleges] The adversary probes for processes running with elevated privileges.

      2 techniques
      • On Windows, use the process explorer's security tab to see if a process is running with administror privileges.
      • On Linux, use the ps command to view running processes and pipe the output to a search for a particular user, or the root user.

  2. Experiment

    They probe what they found.

    1. [Find vulnerability in running process] The adversary looks for a vulnerability in the running process that would allow for arbitrary code execution with the privilege of the running process.

      3 techniques
      • Look for improper input validation
      • Look for a buffer overflow which may be exploited if an adversary can inject unvalidated data.
      • Utilize system utilities that support process control that have been inadequately secured

  3. Exploit

    They carry out the attack.

    1. [Execute arbitrary code] The adversary exploits the vulnerability that they have found and hijacks the running process.

Prerequisites

  • The targeted process or operating system must contain a bug that allows attackers to hijack the targeted process.

Resources required

  • None: No specialized resources are required to execute this type of attack.

Weaknesses it exploits

  • CWE-648 Incorrect Use of Privileged APIs
  • CWE-732 Incorrect Permission Assignment for Critical Resource

Recent CVEs with these weaknesses

  1. 3.9CVE-2026-14543

    The VAPIX Edge storage API, enabling the escalation of user privileges by circumventing filesystem isolation, granting unauthorized access to protected system resources. This flaw can only be exploited after authenticating with an admin-pr…

  2. 7.4CVE-2026-12963

    A vulnerability that could allow a viewer account to gain unauthorized access to network attached storage devices on the server.

  3. 7.3CVE-2026-112125

    Incorrect Permission Assignment for Critical Resource Vulnerability in HA Monitor. This issue affects HA Monitor: from 01-00 before 01-83-01.

  4. 8.5CVE-2026-125396

    Ghostscript before 10.08.0 contains a -dSAFER bypass vulnerability in the .putgstringcopy procedure in gs_fonts.ps, which calls the privileged .forceput operator without checking operand types. Attackers can supply crafted PostScript or PD…

  5. 7.8CVE-2026-114031

    Incorrect permission assignment allows local privilege escalation to SYSTEM on affected releases of the Illumio VEN for Windows. Code execution as NT AUTHORITY\LOCAL SERVICE on the Windows host is required to exploit this vulnerability. Th…

  6. 7.8CVE-2026-119474

    Incorrect Permission Assignment for Critical Resource vulnerability in HAVELSAN Inc. Liman Render Engine allows Privilege Escalation. This issue affects Liman Render Engine: before 1.2-81.

  7. 4.8CVE-2026-124039

    Gitleaks through 8.30.1 contains an incorrect permission assignment vulnerability that allows local users to read scan reports because cmd/root.go creates the --report-path file with os.Create and default permissions. Unless --redact is pa…

  8. 5.3CVE-2026-112910

    filelock is a platform-independent file lock for Python. From 3.10.0 until 4.2.1, filelock on Windows ignores the mode argument for WindowsFileLock files and the ReadWriteLock SQLite database. A lock created with mode=0o600 receives the pa…

The newest records naming one of them. Each weakness's page lists them all.

Part of
Can follow

MITRE's words, unchanged: CAPEC-234 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.