Pyrus Sync for Windows contains a local privilege escalation vulnerability caused by missing authorization controls in its PyrusSyncService Windows service. The flaw allows a user without elevated privileges to create files via the ISyncService contract. Because files can be written to arbitrary locations, an attacker could place malicious payloads, modify configuration, or establish persistence, effectively elevating their privileges within the affected system.

The vulnerability affects the Pyrus Sync application for Windows operated by the Pyrus vendor. No specific product versions were listed, so all installed releases of Pyrus Sync for Windows are potentially impacted until an official update is available.

Risk assessment indicates that the vulnerability is exploitable in a local environment and can be leveraged to gain higher privileges by creating files that the system or users may subsequently execute. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but the lack of authorization control carries a high severity. Attackers already authenticated to the machine can invoke the ISyncService contract to create files, with no network exposure required. The absence of a CVSS score makes precise quantification difficult, but the local privilege escalation nature suggests a significant impact on confidentiality, integrity, and availability if exploited.