The vulnerability resides in older HP ThinPro builds where insufficient synchronization can lead to race conditions that may allow an attacker to manipulate system processes or bypass safeguards. The weakness, classified as CWE‑354, indicates that the operating environment does not reliably coordinate concurrent operations, potentially giving a malicious user the opportunity to gain elevated privileges or tamper with protected resources. The CVE description notes that the earlier releases "could potentially contain security vulnerabilities," implying that the exact effect is unspecified, but such races could enable unauthorized access or tampering.

HP ThinPro 8.1 builds older than Service Pack 10 and HP ThinPro 9 builds older than Service Pack 3 are affected. Devices or workstations running those earlier service packs are at risk. The vendor has released Service Packs 10 for ThinPro 8.1 and 3 for ThinPro 9 that contain mitigations for the underlying weaknesses.

The CVSS base score of 6.8 places the vulnerability in the moderate severity range. No EPSS data is available and it is not listed in CISA's KEV database. Because the description does not specify a remote delivery method, the likely attack vector is local or physical, requiring some level of user access to the affected system. No public exploit is currently documented, but the moderate score and lack of a known exploit suggest that correcting the software via the vendor service packs is the recommended precaution.