Acronis True Image for Windows contains a flaw that allows a local attacker to gain elevated privileges by hijacking a library file. The issue is classified as path manipulation (CWE‑427). When the application loads a library from a directory that the attacker can control, arbitrary code can be executed with the application's privileges, potentially granting system‑level access.

Users running any Windows build of Acronis True Image prior to build 42902 are affected. The vulnerability applies to installations that have not installed that build or later updates.

The CVSS score of 6.7 signifies moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no known public exploits. The likely attack vector is that an attacker must be able to place a malicious DLL in a directory considered by True Image, which requires local access or the ability to run the application with elevated permissions. Once the DLL is loaded the attacker can execute arbitrary code with the privileges of the process, posing a significant risk to the affected systems.