This vulnerability in LLM-on-Ray before version 1.0 involves a failure in protection mechanisms within Ring 3 user applications, enabling an escalation of privilege. The attack requires an unprivileged software adversary combined with a privileged user and low complexity attack vector, potentially via local access with passive user interaction. The vulnerability affects confidentiality, integrity, and availability at a high level within the vulnerable system context, but no broader system-level impacts are reported. The CVSS 4.0 base score is 5.4, reflecting medium severity. No patch or remediation level is currently documented.

The vulnerability allows escalation of privilege, which can compromise the confidentiality, integrity, and availability of the vulnerable system at a high level. However, it does not result in further impacts on system-wide confidentiality, integrity, or availability beyond the immediate vulnerable context. The attack requires local access and passive user interaction, with low attack complexity but needing a privileged user combined with an unprivileged adversary.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time.