The flaw allows a local attacker to place a malicious DLL in a directory that the Acronis DeviceLock DLP application will load, resulting in execution of arbitrary code with elevated privileges. This is a classic DLL hijacking vulnerability (CWE‑427) and can be leveraged to gain system-level access, compromising user confidentiality, integrity, and availability.

Acronis DeviceLock DLP for Windows, any build older than 9.0.15051.93227.

The CVSS score of 7.3 indicates a high severity local privilege escalation. The EPSS score is not available, but the absence of a KEV listing suggests no current widespread exploitation. Attack requires local user access and write permissions to the DLL loading directory; once executed, the attacker can run code with SYSTEM rights.