The vulnerability lies in the VSL privileged helper's use of NSXPC for interprocess communication. The helper's function that should validate new connections does not perform any verification, which allows any local process to establish a connection to its XPC service. Once connected, an attacker gains access to the HelperToolProtocol, including the unprotected functions 'writeReceiptFile' and 'runUninstaller'. These functions permit arbitrary file writes with any data and arbitrary command execution, respectively, enabling a local attacker to modify critical system files or execute programs with elevated privileges. The absence of validation results in a clear privilege escalation path without requiring exploitation of additional weaknesses.

This flaw affects Vienna Symphonic Library GmbH's Vienna Assistant software. No specific version information is provided in the CNA data, so any installation of Vienna Assistant that includes the VSL privileged helper is potentially vulnerable.

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% suggests a low probability of widespread exploitation under current conditions. The vulnerability is not listed in the CISA KEV catalog, supporting the low exploit likelihood assessment. The likely attack vector is local: any process running on the same machine can connect to the vulnerable XPC endpoint. Given the lack of client validation and the powerful operations exposed by the helper, a local attacker can achieve full privilege escalation with minimal prerequisites.