The vulnerability in Matrix42 Empirum's PBackupVSS.exe involves the creation of a named pipe (\\.\pipe\PBackupVSS) with a discretionary access control list (DACL) that grants GENERIC_READ and GENERIC_WRITE permissions to all authenticated users. This misconfiguration allows a low-privileged local attacker to connect to the pipe and send crafted inter-process communication (IPC) messages. By exploiting an untrusted search path, the attacker can place a malicious shadow.exe in a controlled working directory, causing arbitrary command execution with SYSTEM privileges. This results in a local privilege escalation vulnerability. The affected versions are all releases before 25.5 and 26.x releases before 26.2. No official patch or remediation level is currently documented in the provided data.

A low-privileged local attacker can escalate privileges to SYSTEM by exploiting the insecure permissions on the named pipe and leveraging an untrusted search path to execute arbitrary commands. This compromises system integrity and could lead to full system control by an attacker with initially limited access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the named pipe if possible and monitor for suspicious local activity. Avoid placing untrusted executables in directories that could be used in the untrusted search path exploitation. Follow vendor updates closely for an official fix.