CVE-2023-40516: High Local Privilege Escalation in LG Simple Editor

CVE-2023-40516 is a high flaw in LG Simple Editor 3.21.0: the product installer has a local privilege escalation from incorrect folder permissions. NVD scores it 7.8 (High). LG told the Zero Day Initiative it will not fix it, so no patch exists. Restrict access to the application or remove it.

What's affected

The record lists one product and one version: LG Simple Editor 3.21.0 (the CPE vendor field reads lg). The weakness class is CWE-732.

The flaw sits in the product installer, which sets incorrect folder permissions. The record scores confidentiality, integrity and availability all as high, but the attack vector is local and low privileges are required.

No fixed version exists. The Zero Day Initiative advisory ZDI-23-1218 (tracked as ZDI-CAN-20327) says ZDI reported the issue to LG on 14 February 2023. On 8 August 2023 the vendor stated it does not plan to fix it now or in the future. ZDI then published it as a zero day advisory on 24 August 2023. NVD added the record on 3 May 2024. The record does not say whether versions other than 3.21.0 are affected, and the advisory names no safe version.

It is not in CISA's Known Exploited Vulnerabilities catalog, and the advisory does not say it is exploited in the wild.

How to check if you're exposed

There is no package feed to scan for this one, so exposure comes down to whether the application is installed and reachable. This one needs local access.

On a Windows host, check whether LG Simple Editor is installed and which version:

Get-Package | Where-Object Name -like "*Simple Editor*"

Also look in Apps and features, because not every installer registers with that command. Then list listening sockets and match the owning process to the application:

netstat -ano | findstr LISTENING
tasklist /FI "PID eq 1234"

Replace 1234 with a process ID from the first command. If you find version 3.21.0 and the service answers from any network other than a trusted administration segment, treat the host as exposed. Add the host to your software inventory either way, so a later fix notice from LG reaches someone who can act on it.

What to do now

1. Inventory every host that has LG Simple Editor installed and record the version.
2. Remove network access you do not need. Block inbound connections to the service at the host firewall and the perimeter, and allow only named administrators.
3. On shared hosts, limit who can log in. Uninstall the product where it is not in use, because the vendor will not fix the installer permissions.
4. Watch for changes to files under the application's install folder and for unexpected processes running as SYSTEM from that location.
5. Ask LG whether a patched version or a replacement exists, and recheck the Zero Day Initiative advisory for updates.

Why it matters

Incorrect permission assignment means files or folders end up writable by accounts that should only read them. When the folder holds something a privileged process later loads or runs, a low-privileged user can substitute their own content and gain that process's authority. Here the advisory says the installer sets the permissions wrongly and the result is code execution as SYSTEM.

This is a different risk from the network bugs in the same product. It only matters after someone already has a foothold, such as a standard user session on a shared workstation or server. It is still worth fixing in places where many people share a host. The vendor has said it will not patch this, which is the main reason the guidance here is about reducing exposure.

This is one of many records filed against LG Simple Editor 3.21.0 from the same ZDI batch. Most are network bugs. This one is the local counterpart.

Quick check

Sources

• Zero Day Initiative advisory ZDI-23-1218
• Safeguard Gold entry for CVE-2023-40516
• NVD record for CVE-2023-40516, as supplied in the Safeguard CVE dataset

Last reviewed: 19 October 2026.