The vulnerability resides in the libacl pathname‑based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() prior to version 2.4.0. It allows a local attacker who can influence any component of a pathname processed by a privileged caller to redirect ACL read or write operations to unintended files or directories. The ability to manipulate access control lists on arbitrary files or directories enables unauthorized elevation of privileges, as the attacker can grant themselves or others higher access rights or remove restrictions. The weakness is a path‑transmission flaw (CWE‑59).

The ACL library (acl project) versions earlier than 2.4.0 are affected. Any system that uses these versions for ACL management, such as Linux distributions or custom applications that embed libacl, is vulnerable if a local user can write or symlink filenames to the processes that invoke the vulnerable functions.

The CVSS score of 8.4 indicates high severity, with local privilege escalation as the primary consequence. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog. However, because the flaw requires local access and the attacker must control a pathname component, the exploitation likelihood depends on local access to privileged callers. Once exploited, the attacker can modify ACLs for any file or directory that the privileged process can reach, effectively escalating privileges on the host.