The vulnerability is an OS command injection flaw in Dell Display and Peripheral Manager (DDPM Mac) versions earlier than 2.3. A low‑privileged local attacker can supply crafted input that the software interprets as operating system commands, potentially executing arbitrary commands. The weakness is identified as CWE-78, and the impact is that confidentiality, integrity, and availability could be compromised if malicious commands are run.

Dell Display and Peripheral Manager on macOS, specifically any deployment running a version older than 2.3. Users who have local access to the system and can run DDPM are susceptible.

The CVSS score of 7.8 categorizes this as high severity. No EPSS score is available, but the lack of data does not negate the potential for exploitation. The vulnerability is not listed in the CISA KEV catalog, but that does not reduce its risk. The likely attack vector is local access: a low‑privileged user must be able to interact with DDPM on the host. Once the flaw is triggered, the attacker can execute any command with the privileges of the DDPM process.