CVE-2025-61228 describes a local code execution vulnerability in Shirt Pocket SuperDuper! versions 3.10 and earlier. The flaw resides in the software update mechanism, which can be exploited by a local attacker to execute arbitrary code. The vulnerability is classified under CWE-494 (Download of Code Without Integrity Check), indicating that the update process does not properly verify the integrity or authenticity of the code being executed. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects that the attack requires local access with low complexity and privileges, no user interaction, and results in high impact on confidentiality, integrity, and availability.

Successful exploitation allows a local attacker to execute arbitrary code with the privileges of the affected software, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability at a high level. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict local access to trusted users only and monitor for suspicious activity related to the software update process.