The vulnerability is a local privilege escalation flaw caused by insecure folder permissions in Acronis True Image. A non‑privileged user can read, modify, or delete files that should be protected, allowing the attacker to assume administrative rights. This could lead to the installation of malware, data theft, or other malicious actions.

Affected Windows versions of Acronis True Image built before build 42902. Users running these builds should treat them as vulnerable.

The CVSS base score is 6.7, indicating moderate severity. No EPSS value is available, and the vulnerability is not listed in the CISA KEV catalog. The flaw requires local access and a user account; by increasing local privileges, an attacker can compromise the system. The risk is higher on systems with standard user accounts and insecure permissions.