This vulnerability arises from a time‑of‑check to time‑of‑use race condition in the CODESYS Installer. When a legitimate user elects to update the CODESYS Development System or launches the installer, a low‑privileged local user can interleave actions to trick the installer into executing with elevated rights. The flaw permits an attacker to elevate privileges on the affected system.

The advisory lists the CODESYS Installer as the affected component. No specific version numbers are provided, so all installations that rely on the current installer may be vulnerable unless a patch is applied. Users who trigger the self‑update prompt or start the installer are at risk.

The CVSS score of 7.3 indicates a high‑severity local privilege escalation, but the EPSS score is less than 1 % and the flaw is not in the CISA KEV catalog, pointing to a low likelihood of widespread exploitation. The attack requires local presence and the ability to confirm a self‑update prompt or initiate installation, which limits the attacker’s opportunities. If successfully exploited, the attacker could compromise the host.