<qhelp>

<overview>

This query indicates that there is a call to a function of the `CreateProcess*` family of functions, which introduces a security vulnerability.

</overview>

<recommendation>

Do not use `NULL` for the `lpApplicationName` argument to the `CreateProcess*` function.

If you pass `NULL` for `lpApplicationName`, use quotation marks around the executable path in `lpCommandLine`.

</recommendation>

<example>

In the following example, `CreateProcessW` is called with a `NULL` value for `lpApplicationName`, and the value for `lpCommandLine` that represent the application path is not quoted and has spaces in it.

If an attacker has access to the file system, they can elevate privileges by creating a file such as `C:\Program.exe` that will be executed instead of the intended application.

To fix this issue, specify a valid string for `lpApplicationName`, or quote the path for `lpCommandLine`. For example:

`(LPWSTR)L"\"C:\\Program Files\\MyApp\"", // lpCommandLine`

</example>

<references>
- CreateProcessA function (Microsoft documentation).
- CreateProcessW function (Microsoft documentation).
- CreateProcessAsUserA function (Microsoft documentation).
- CreateProcessAsUserW function (Microsoft documentation).
- CreateProcessWithLogonW function (Microsoft documentation).
- CreateProcessWithTokenW function (Microsoft documentation).
</references>

</qhelp>