The vulnerability permits a local attacker to bypass OpenEDR 2.5.1.0’s self‑defense mechanism by renaming a malicious executable to a trusted process name such as csrss.exe, edrsvc.exe, or edrcon.exe. This trick enables the attacker to interact with the OpenEDR kernel driver and invoke privileged API calls—including configuration changes, process monitoring, and IOCTL communication—that are intended to be restricted to trusted components. Although this alone does not grant SYSTEM privileges, it breaks the trust model and can facilitate further exploitation that may lead to full local privilege escalation.

Affected system: Xcitium OpenEDR version 2.5.1.0 as identified by the CPE string cpe:2.3:a:xcitium:openedr:2.5.1.0:*:*:*:*:*:*.*

The CVSS score of 7.8 indicates high severity, but the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The issue is not listed in the CISA KEV catalog. Attackers would need local access and the ability to place or rename a file on the system, which is a common privilege escalation scenario for a local threat actor. The risk is significant for environments relying on OpenEDR’s self‑defense to enforce component trust boundaries.