This vulnerability in Synology ActiveProtect Agent arises from an origin validation error that permits local users to write arbitrary files containing restricted content and to trigger denial-of-service conditions during the software installation process. The issue affects versions prior to 1.1.0-0439. The CVSS 3.1 base score is 6.1, reflecting that the attack vector requires local access with low complexity and no privileges but user interaction is needed. The impact includes integrity loss and high availability disruption. No official patch or mitigation details have been provided by Synology at this time.

The vulnerability allows local attackers to write arbitrary files with restricted content, potentially leading to integrity issues on the affected system. Additionally, it can cause denial-of-service during installation, impacting system availability. Confidentiality is not affected. There are no reports of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local user access to systems running vulnerable versions of Synology ActiveProtect Agent and monitor installation processes for anomalies.