Local privilege escalation via unquoted service path

Unquoted service path handling in Splunk Universal Forwarder before 5.0.3 allows local users to gain elevated Windows privileges. The Windows installer registers the SplunkForwarder service with the whitespace-containing splunkd.exe path left unquoted, so service startup can select an attacker-planted executable earlier in the path. Exploitation requires local filesystem access and permission to place an executable in a searched parent directory; successful execution inherits the service account's privileges.