Inspection Support System EUVD-2026-109611

Requires local access to a system running the Electronic delivery item Inspection Support System (version up to and including Ver.4.0.36) as a low-privileged authenticated user (CVSS PR:L). The concrete prerequisite is the application's improper installation-folder file permissions, which let a non-privileged user tamper with (overwrite) application files that are later executed in a more privileged context, producing arbitrary code execution. Limiting factors: not remotely exploitable (AV:L) - the attacker must already have a local foothold; no network vector; exploitation depends on the vulnerable version being installed and on the affected files being invoked by a higher-privileged user or service.

This is a locally-exploitable integrity/privilege flaw rather than a remote emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) confirms it requires local access with low privileges and no user interaction, yet yields full impact on the vulnerable system (VC:H/VI:H/VA:H, score 8.5). CWE-276 (incorrect/insufficient file permissions) combined with the description's 'files in the installation folder may be tampered with, resulting in arbitrary code execution' points to a classic local privilege-escalation pattern: a low-privileged user overwrites application files that later run in a more privileged context. No KEV listing, no EPSS score, and no PoC are present in the input, so there is no public exploit identified at time of analysis - exploitation requires an attacker to already have a local foothold. The vuln.today decision label is 'this_week' (not act_now/emergency), which is consistent with a serious but not remotely-wormable local issue. Net: a genuine high-severity local EoP/RCE worth prompt patching for exposed deployments, but not a drop-everything internet-facing threat. Missing data to note: no EPSS, no KEV, no PoC, and no explicit fixed version in the supplied references.

A low-privileged local user (or malware already running at low privilege) on a machine where the Inspection Support System is installed writes to the application's installation folder, which has overly permissive access controls. The attacker replaces or modifies an executable or library file; when the application or a higher-privileged user/service subsequently runs it, the attacker's code executes with elevated privileges. No public exploit code is identified at time of analysis, and exploitation requires prior local access.