The flaw is an unquoted service path in the SAPSprint service binary. When the service starts automatically on Windows, a malicious executable placed in the directory that holds the service binary is invoked with LocalSystem privileges, allowing an attacker who can run code on the host to achieve system‑level access. This weakness corresponds to CWE‑428 and carries a CVSS score of 8.5.

Brother SAPSprint version 7.60, deployed on Windows operating systems, is affected. Any installation that runs the SAPSprint service without quoting the executable path is vulnerable. This applies to all machines where the service is enabled and starts automatically.

The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, implying no known widespread exploitation yet. Nonetheless, the local attack vector is straightforward: the attacker must have local user privileges sufficient to write to the Program Files directory used by the service. Upon creating a malicious payload and restarting the service, the exploit elevates privileges to LocalSystem, providing unrestricted access to the system.