PSEvents.exe, the background component of several Panda Security products, runs at SYSTEM level and automatically loads DLL files from a directory that can be written by a normal user. The lack of path validation allows an attacker to drop a malicious DLL into that folder, causing the service to execute the code at full SYSTEM privileges. This elevation of privilege can result in arbitrary code execution with the highest available local rights.

The vulnerability affects Panda Security Panda Antivirus Pro 2016, Panda Global Protection 2016, Panda Internet Security 2016, and Panda Small Business Protection—specifically all releases up to version 16.1.2. These products are used in many enterprise and small‑business environments.

The CVSS score of 8.5 indicates high severity, and the EPSS score of 8% indicates a higher exploitation probability. Although the vulnerability is not listed in the CISA KEV catalog, the low‑privileged user requirement means local attackers can achieve SYSTEM code execution by writing a DLL to the monitored directory. Based on the description, the likely attack vector is a local file‑write compromise that leads to DLL hijacking.