This issue is an improper input validation flaw that allows a local user to gain elevated privileges. The vulnerability is classified under CWE‑787, indicating a buffer overflow or out‑of‑bounds write condition. If successfully exploited, an attacker who is already authenticated on the target machine could execute arbitrary actions with higher permissions, compromising integrity and confidentiality of the system and any data managed by the affected applications.

Acronis DeviceLock DLP for Windows prior to build 9.0.93212 and Acronis Cyber Protect Cloud Agent for Windows prior to build 42183 are affected. The flaw is present in Windows installations of these products that have not yet been updated to the specified build numbers.

The CVSS score of 7.8 indicates a high‑severity vulnerability, while the EPSS score is not available and the flaw is not listed in CISA KEV. The likely attack vector is local, requiring the attacker to have access to the machine where the vulnerable application runs. Once accessed, the flaw can be triggered by providing malformed input that leads to the out‑of‑bounds write, granting the attacker escalated privileges.