An attacker with only local, non‑privileged access can exploit a vulnerable IOCTL interface exposed by the OpenEDR 2.5.1.0 kernel driver. By altering the DLL injection path to a user‑writable location, the attacker causes OpenEDR to load a malicious DLL into processes that run with SYSTEM privileges. This leads to arbitrary code execution with full system rights, allowing the attacker to read, modify, or delete data and disable services.

The vulnerability affects the OpenEDR product, specifically version 2.5.1.0. No additional vendor or product details are supplied by the CNA.

The CVSS score of 8.8 classifies the flaw as high severity. The EPSS score of less than 1% indicates a low probability of exploitation in the wild. The issue is not listed in the CISA KEV catalog. Exploitation requires local interaction with the kernel driver, and the path‑redirection weakness (CWE‑427) makes the attack straightforward once the vulnerable IOCTL call can be invoked.