The vulnerability is an uncontrolled search path element in the OpenSSL DLL component used by Synology BeeDrive for desktop, allowing local users to execute arbitrary code via unspecified vectors. This flaw, classified as CWE‑427, can lead to complete compromise of the affected machine, as any locally privileged user could inject malicious DLLs into the PATH that the application subsequently loads. The primary impact is arbitrary local code execution, potentially granting an attacker administrative privileges if the vulnerable user account has elevated rights.

BeeDrive for desktop versions prior to 1.3.2‑13814 are affected. The issue exists in every build that includes the vulnerable OpenSSL DLL prior to that version. Users running Editions of BeeDrive with the default installation path are at risk until the vendor releases a fix or until the component is replaced.

With a CVSS score of 7.8 the flaw is considered high severity, but the EPSS score is not available, and it is not listed in the CISA KEV catalog. Exploitation is constrained to local users, and the vulnerability requires a local user to trigger an unspecified vector to load a malicious DLL. The lack of network or remote vectors limits widespread exploitation, yet the impact remains critical for systems where local users have elevated privileges.