The vulnerability is caused by an insecure configuration of an XPC service that allows a local user to create or modify privileged data, resulting in the ability to gain root privileges. This flaw falls under CWE‑269, Improper Privilege Management, and enables an attacker to read, alter, or delete sensitive system data and control the machine.

Affected products include Acronis True Image for macOS before build 42389, Acronis True Image OEM for macOS before build 42571, Acronis True Image for SanDisk for macOS before build 42198, and Acronis True Image for Western Digital for macOS before build 42197.

The CVSS score of 8.8 indicates a high severity, yet the EPSS score of <1% shows a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires local access to the macOS system and the presence of the vulnerable XPC service running with elevated privileges. If an attacker local or remote with local privileges can run code, they could execute the service to raise privileges.