Acer Care Center exposes a local attack vector where a named pipe is created with an overly permissive security descriptor. The ACCSvc service accepts a message type 0x03 on this pipe and will terminate with exit code 1067 (ERROR_PROCESS_ABORTED) when it receives a specially crafted payload. This flaw permits any authenticated local user to connect to the pipe, send the malicious message and force the service to crash, resulting in service disruption for other users who rely on Acer Care Center functionality. The vulnerability is classified under CWE-269, which indicates an improper privilege or permission assignment.

Acer Care Center is the affected product. Versions prior to the latest update 4.00.3060 are vulnerable; the update is applied by installing version 4.00.3060 as published by Acer.

The CVSS score of 6.8 signals moderate severity. Exploitation requires local user authentication and does not depend on network exposure or elevated privileges beyond those of a regular user. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, indicating no confirmed exploitation at this time. Nevertheless, the impact on availability makes it a valuable target for malicious actors with local access.