AVACAST, developed by eMPIA Technology, contains an unquoted service path flaw that allows a local privileged attacker to place a malicious executable in a specific directory. When the AVACAST service starts, the attacker’s executable is invoked with system privileges, enabling full compromise of the host. This vulnerability is classified as a CWE‑428 weakness.

All versions of AVACAST prior to version 5.10.10.45 are affected. Users should verify that the installed version is earlier than 5.10.10.45 and plan an upgrade.

The CVSS base score is 8.4, indicating high severity. EPSS data is not available, and the vulnerability is not currently listed in the CISA KEV catalog. Since the flaw requires local privilege, the most likely attack vector involves an attacker already on the machine with administrative rights. Once the attacker gains write access to the AVACAST installation directory, they can drop the malicious program and trigger its execution by restarting the service.