CVE-2024-50590 is a local privilege escalation vulnerability in Elefant, a medical office software, where attackers can gain SYSTEM level access. Local attackers can overwrite service binaries due to weak permissions, leading to arbitrary code execution. This flaw allows attackers with local access to escalate their privileges on the Windows system.

The vulnerability exists because the Elefant installation directory, "C:\Elefant1," is writable by all users, and the Firebird database services run as “NT AUTHORITY\SYSTEM”. By replacing the service executable, a local attacker can execute arbitrary code with the highest privileges after a reboot. The SVRS score is 30, indicating a moderate risk that should be addressed, despite not being considered critical, it still represents a significant security concern if local access is compromised. Successfully exploiting this vulnerability grants attackers complete control over the affected system. This underscores the importance of restricting write access to program directories and implementing robust permission controls.