Based on the updated description, the vulnerability permits a local attacker who can place a crafted file in a directory monitored by DeepCreative to trigger execution of arbitrary code due to insecure file permissions (CWE‑277). The likely attack vector is local file placement. The attacker controls the file’s content, and the application will execute it, potentially enabling unauthorized control over the application and the host operating system. The impact compromises confidentiality, integrity, and availability of the affected host.

The affected product is DeepCool DeepCreative, versions prior to 1.2.12. No other vendors or products are listed in the CNA data.

The CVSS score of 7.8 indicates a high severity, and the EPSS score is less than 1%. Although it is not listed in CISA’s KEV catalog, this local code execution vulnerability is a very high‑risk condition. If the attacker can write files into a directory monitored by DeepCreative, they can execute arbitrary code without additional authentication. The exploitation likelihood is high for systems where the application runs with elevated privileges or unsegmented file permissions, and administrators should assume the risk remains elevated until a vendor update is applied.