This vulnerability (CVE-2026-33092) involves improper handling of environment variables in Acronis True Image OEM and Acronis True Image on macOS, which leads to local privilege escalation. An attacker with local access and low privileges can exploit this flaw to gain higher privileges on the affected system. The issue is tracked under CWE-15 (External Control of System or Configuration Setting). The affected versions are those prior to build 42571 for Acronis True Image OEM and prior to build 42902 for Acronis True Image on macOS. The CVSS 3.0 vector indicates low attack complexity, no user interaction required, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently provided, and no exploits are known in the wild.

Successful exploitation of this vulnerability allows a local attacker to escalate privileges on the affected macOS system, potentially leading to full system compromise. The impact affects confidentiality, integrity, and availability of the system. However, exploitation requires local access and low privileges, limiting the attack surface to users with some system presence.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local access to trusted users only and monitor for suspicious local activity. No official patch or workaround information is currently available from Acronis.