The vulnerability arises from KeePassXC’s use of OpenSSL. During startup, the application loads the OpenSSL configuration from a location that is not protected by the operating system. This omission allows an attacker who can already execute code at the current user level to supply a configuration file that contains an uncontrolled search path element. The threat model is local; the flaw is a classic CWE‑427 — Uncontrolled Search Path Element.

Affected installations are those that run the KeePassXC application, specifically the KeePassXC:KeePassXC product family. No version range was specified in the CNA information, but the advisory references indicate that all actively supported releases are susceptible until a patch is released.

The CVSS score of 7.3 indicates a high‑risk condition. Exploitability requires the attacker to first acquire low‑privilege code execution, which is a prerequisite that reduces the likelihood of remote attacks. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, which suggests it has not yet been widely exploited. Nevertheless, the combination of a local trusted process and the ability to inject arbitrary code warrants prompt attention.