The vulnerability allows a local attacker to invoke the shutdownMachine and putMachineToSleep functions in PostCompressionActions.cpp to execute arbitrary code on the host system. This grants the attacker direct control over the process that terminates or suspends the machine, enabling the launch of malicious payloads or further system compromise.

The flaw exists in all current releases of the caesium-image-compressor project hosted by Lymphatus up to and including commit 02da2c6. No specific product version numbers are provided beyond the commit identifier, but every version before the referenced commit is affected.

Because the attack requires local access to run the application, exploitation is limited to users who can execute the compressor binary. The EPSS score is unavailable and the vulnerability is not listed in CISA KEV, suggesting no publicly known exploits at this time. Nonetheless, local code execution remains a high‑impact condition, and an attacker who gains local user capability can take full control of the affected system.