A flaw was identified in Qihoo 360 Total Security version 6.0 that affects the RpcStringBindingComposeW routine within the Nucleus Engine Monitoring Logic component. Manipulating the NetworkAddr argument causes a failure in the component’s built‑in protection mechanism. The CVE description does not explicitly state that an attacker can gain direct code execution or privilege escalation; it indicates that the failure may allow an attacker to bypass established protection controls, potentially enabling unauthorized actions on the system.

The vulnerability targets Qihoo 360 Total Security 6.0, specifically the Nucleus Engine Monitoring Logic module and its RpcStringBindingComposeW function. No other product versions are referenced in the current data.

The CVSS score of 8.5 places this defect in the high‑severity class. An exploit is publicly available and requires local access to the affected host. Although an EPSS estimate is not currently available, the combination of a high CVSS and a publicly released exploit elevates the threat level for environments where the software runs with elevated privileges or is used by trusted local users. The vulnerability is not listed in the CISA KEV catalog, but the local attack vector and high severity indicate that it warrants immediate attention.