The flaw resides in the discord_rpc module of the Discord Client, where the application loads a file from an unsecured location. This uncontrolled search path element allows a locally present attacker who can already run code with low privileges to execute arbitrary code as the user of the application. The vulnerability directly increases the privileges of a local threat actor, potentially giving them full control over the target system.

Affecting all installations of the Discord Client. No specific version range is provided, so the risk applies to every released build until patched. Users of any Discord desktop edition should be aware that the discord_rpc module is the attack vector.

The vulnerability carries a CVSS score of 7.3, indicating moderate‑to‑high severity, and an EPSS score of less than 1 %, suggesting a low likelihood of widespread exploitation at the present. It is not listed in the CISA KEV catalog. Exploitation requires a local attacker with the ability to execute low‑privileged code; no remote trigger is necessary or described. Once the attacker achieves code execution, privilege escalation can be performed in the context of the victim user, bypassing standard access controls.