The vulnerability is located in the osslsigncode.c component of the osslsigncode project, affecting versions 2.10 and earlier. A remote attacker can exploit the flaw to obtain elevated privileges on the host system. The weakness is identified as improper privilege management and hard‑coded credentials, allowing an attacker to bypass security controls and run code with higher authority, potentially compromising the entire system.

Any installation of the osslsigncode tool released by the osslsigncode_project is affected, specifically versions 2.10 and older. The issue is platform‑agnostic and applies to all supported hosts where the vulnerable binaries are used.

The CVSS score of 9.8 indicates critical severity, and the EPSS score is below 1%, suggesting current exploitation is unlikely and the vulnerability is not in the CISA KEV list. The attack requires a remote attacker to invoke osslsigncode, implying that broadcast or remote usage of the tool could provide the necessary vector. Despite the low current exploitation probability, the high severity and privilege escalation capability necessitate prompt mitigation.