The vulnerability in Aeon arises from the load_human_activity_segmentation_datasets method, where user-supplied strings are not properly validated before being used to execute Python code. This improper validation enables remote attackers to execute arbitrary code in the context of the current process. Exploitation requires user interaction, specifically the target visiting a malicious webpage or opening a malicious file. Aeon has released a patch to correct this issue, as referenced in their GitHub commit 751918052c0cce266b4f7cd4b084408526efc015.

Successful exploitation allows remote attackers to execute arbitrary code with the privileges of the Aeon process, potentially leading to full compromise of the affected system. The vulnerability impacts confidentiality, integrity, and availability, as indicated by the CVSS vector (C:H/I:H/A:H). User interaction is required for exploitation, which limits the attack vector to scenarios involving malicious content delivery.

Aeon has issued an official update that corrects this vulnerability. Users and administrators should apply the update from the official Aeon repository to remediate this issue. No additional mitigation steps are indicated beyond applying the vendor-provided patch.