This vulnerability in Lymphatus caesium-image-compressor permits local code execution through the shutdownMachine and putMachineToSleep functions in the PostCompressionActions.cpp source file. The issue affects all versions up to and including commit 02da2c6. The CVSS 3.1 base score is 7.8, reflecting high impact with local attack vector, low attack complexity, requiring low privileges and no user interaction, and resulting in high confidentiality, integrity, and availability impacts. The weakness is associated with CWE-94 and CWE-77, indicating improper code generation and command injection risks. No patch or official remediation level has been provided by the vendor or authoritative sources as of the published date.

A local attacker with limited privileges can exploit this vulnerability to execute arbitrary code on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the system. This could allow the attacker to control system behavior, disrupt operations, or access sensitive information. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users only and monitor for suspicious activity related to the shutdownMachine and putMachineToSleep functions. Avoid running the vulnerable software on critical systems where possible.