Based on the description, the vulnerability requires an attacker with local control to exploit the Secure Access Windows client. An arbitrary read/write flaw permits sending malformed data to the client’s API, which results in elevation to system privileges. The weakness stems from improper input validation and memory manipulation, leading to full system compromise with complete control over the affected machine.

Absolute Software Secure Access for Windows clients, versions prior to 14.50.

The exploit path demands local access; once the client machine is compromised, a malformed API request can elevate privileges to system. The CVSS score of 8.5 indicates high severity, while the EPSS score of <1% and absence from KEV suggest low likelihood of broad exploitation. The local nature of the attack limits reach to insiders or physically compromised devices, but once achieved, the impact is severe.