The vulnerability is an OS command injection flaw in RPG MAKER MV and MZ that allows an attacker to execute arbitrary operating system commands when a specially crafted save file is loaded. This attack can compromise confidentiality, integrity, and availability of the affected system, as the injected commands run with the privileges of the application. The weakness matches CWE-78.

The affected items are RPG MAKER MV and RPG MAKER MZ by Gotcha Gotcha Games Inc. No specific version numbers are provided, so all releases may be impacted until a patch is released.

The CVSS score of 8.4 indicates a high severity vulnerability. Because the EPSS score is not available, the current exploitation probability cannot be quantified, but the lack of a KEV listing suggests no widespread exploitation has yet been reported. Likely, an attacker must deliver a malicious save file to the victim; the vector could be local or remote if the file can be propagated through shared storage or network access. Once the file is opened, the injected command is executed, making the attack highly destructive.