The vulnerability stems from a missing authentication check for a critical operation exposed via a local named pipe in the VOCALOID6 Editor. Any process that runs under the same local user account as an instance of the editor can invoke this operation without authorization, allowing an attacker to elevate their privileges on the local machine. The flaw is a classic example of CWE‑306, where lack of authentication enables unauthorized function access, potentially leading to broader system compromise if the attacker can execute additional code or manipulate protected resources.

The affected product is Yamaha Corporation's VOCALOID6 software. No specific version range is listed in the advisory, implying that the exposed named pipe persists across supported releases until patched.

The CVSS score of 4.8 reflects a moderate severity of the flaw, and the EPSS is not available, so exact exploitation probability is unknown. The flaw is not listed in the CISA KEV catalog. The attack vector is local; an attacker must already have access to the same user account that runs the VOCALOID6 Editor to exploit the vulnerability.