Dell OS Recovery Tool EUVD-2026-116488

Requires local access to the system and depends on the attacker being able to write a malicious file into a directory that the Dell OS Recovery Tool (versions prior to 2.4.4) searches ahead of the trusted location, per the CWE-428 untrusted search path. Exploitation is further limited by required user interaction (UI:R): the victim must actually launch the Dell OS Recovery Tool for the planted file to be loaded and command execution to occur. No remote network vector applies (AV:L), and the attacker gains code execution only in the context of the user who runs the tool.

This is a genuine but conditional local-privilege/code-execution risk rather than a mass-exploitation emergency. The CVSS 7.8 is driven by full impact (C:H/I:H/A:H) under a local vector (AV:L) with low complexity (AC:L), but it is gated by required user interaction (UI:R) - the victim must launch the Dell OS Recovery Tool for the planted untrusted search-path element to be loaded. The CVSS vector carries PR:N, so no attacker authentication is required, consistent with the description's 'unauthenticated attacker with local access.' No CISA KEV listing and no public exploit reference are present, so exploitation status is 'no public exploit identified at time of analysis'; EPSS is not supplied in the input, so probabilistic exploitation likelihood cannot be quantified here. There is no SSVC/automatable field provided beyond the vuln.today 'this_week' decision label, which signals near-term but not emergency prioritization. Net: a real, patch-worthy local code-execution issue (CWE-428) best treated as a this-week remediation, not a widespread remote threat, because it needs local access plus the user running the affected tool.

An attacker who already has local, unprivileged access to a machine places a malicious file (e.g., a DLL or executable) in a directory that the Dell OS Recovery Tool searches before the trusted location. When the user subsequently launches the tool, it loads the attacker-controlled file and executes the attacker's code in the user's context. No public exploit code is referenced in the available data; the attack hinges on the local vector (AV:L) and required user interaction (UI:R) in the CVSS vector.