The vulnerability allows a local user to write arbitrary files into the IDrive Cloud Backup Client’s data directory. The id_service.exe process, which runs with SYSTEM privileges, reads UTF‑16 encoded strings from those files to build command line arguments for launching processes. By editing the files, an attacker can specify the path of any executable, which will then be executed under SYSTEM rights. This results in unchecked code execution with the highest privilege level on the host, compromising confidentiality, integrity, and availability of the system.

IDrive Cloud Backup Client for Windows (all versions that install id_service.exe and use the ProgramData\IDrive directory). No specific version range was published, so all current releases with the described behavior are considered vulnerable.

The CVSS score of 7.8 indicates a high impact vulnerability, and the EPSS score of less than 1% suggests a comparatively low probability of exploitation in the wild. The vulnerability is not yet listed in CISA’s Known Exploited Vulnerabilities catalog. Exploitation requires a local user session with write permission to C:\ProgramData\IDrive; the attacker can then place any executable in the monitored files and cause it to run with SYSTEM privileges. The attack vector is inferred to be local, with no disclosed remote code execution path. Overall, the risk is significant because an attacker who can log onto the machine or inject files via an application can achieve full system compromise.