The vulnerability allows a local user to modify configuration files stored in C:\ProgramData\IDrive that are read by the elevated id_service.exe process. These UTF‑16‑LE encoded files are used as command line arguments for starting new processes. By editing the files to contain the path to a malicious executable, an attacker can cause that executable to run under SYSTEM privileges, giving them full control over the host. The impact is a full privilege escalation to the highest local privilege level, compromising confidentiality, integrity, and availability of the system.

IDrive Cloud Backup Client for Windows versions before 7.0.0.64 contain the vulnerable id_service.exe service that runs with SYSTEM rights and monitors files under C:\ProgramData\IDrive. Any system user with write access to that folder can exploit the flaw, so all installations using the default configuration are affected.

The CVSS score of 7.8 indicates a high‑impact local vulnerability, while the EPSS score of less than 1% suggests a comparatively low probability of exploitation in the wild. The catalog entry is not listed in CISA KEV. Exploitation requires a local user session with write permission to C:\ProgramData\IDrive; the attacker can then write a file containing an arbitrary executable path and trigger its execution with SYSTEM privileges. The likely attack vector is local, requiring no remote interface. Overall, the risk remains significant for systems that allow local users write access to the backup client data directory.