The vulnerability stems from incorrect file permissions on an executable used by Acer’s Planet9 background service. The service runs with SYSTEM privileges, while the executable grants excessive permissions to non‑administrative users. An authenticated local user can therefore overwrite or modify the executable, causing the service at startup or after a reboot to run attacker‑supplied code with SYSTEM rights. This results in full system compromise, allowing the attacker to read, modify, or delete any data, install malware, or maintain persistence.

Acer’s Planet9 background service (PLANET9DAService). No specific affected version information is supplied. The vulnerability applies to installations that include the service and the affected executable with incorrect permissions.

The CVSS score of 8.5 indicates a high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local, authenticated user who can physically access the machine or gain user‑level access. Exploitation requires modifying a file that the SYSTEM‑privileged service uses, which is feasible if file permissions are lax. The overall risk is high for any system running Planet9 without the remedial update.