The clash-verge-service-ipc component in Clash Verge Rev versions prior to 2.3.0 exposes an inter-process communication (IPC) endpoint that is accessible by any local user due to incorrect permission settings. This exposure enables local privilege escalation by allowing unauthorized users to interact with the IPC endpoint, which should be restricted. The vulnerability is identified as CWE-732, reflecting improper permission assignment on a critical resource. No official patch or remediation level has been documented yet, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability allows a local attacker to escalate privileges on the affected system, potentially gaining higher-level access than intended. This can lead to full compromise of the affected host, including confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:H/I:H/A:H).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local user access to the affected system and monitor for unauthorized local activity. Avoid running untrusted code or users on the affected system to reduce risk.