The Fan Control application V251 allows a local user to supply a file path in the Open File Dialog that is processed with elevated permissions. This improper privilege handling enables the user to execute actions with administrator‑level access, effectively leaking administrative privileges to an otherwise non‑privileged user. The vulnerability is a classic example of CWE‑269, where privileged operations are performed by a process that may be exploited by a local adversary to compromise the confidentiality, integrity, and availability of the system.

The affected product is the Fan Control application, specifically version V251. No vendor information is publicly available in the advisory, but the application is hosted on GitHub and appears to be a standalone desktop tool. Because the vulnerability is tied to a specific release, only installations of V251 are directly impacted; earlier or later versions may not contain the flaw, but the advisory does not provide explicit version ranges.

The vulnerability carries a CVSS score of 8.8, indicating high severity, and no EPSS score is provided, meaning its exploitation probability has not been quantified. It is not listed in CISA's KEV catalog. Based on the description, the likely attack vector is local, requiring the attacker to run the application and manipulate the file selection dialog. Once triggered, the elevated privileges granted by the application allow the attacker to perform arbitrary privileged actions without additional authentication.