Acer Care Center EUVD-2026-31648

Exploitation requires an authenticated local user session on the target Windows machine - the CVSS 4.0 vector AV:L/PR:L confirms local access and low-privilege authentication are both mandatory prerequisites. The ACCSvc service from Acer Care Center must be installed, running, and at version 4.00.3058 or below. The attacker must know or discover the Named Pipe path exposed by ACCSvc and understand the message framing sufficient to send a type 0x03 payload. Limiting factors: (1) physical or authenticated remote desktop access to the target machine is required - no network-level exploitation path exists; (2) impact is strictly a service crash with no code execution, no data exfiltration, and no integrity modification; (3) Acer Care Center is OEM-bundled software typically absent from enterprise-managed or non-Acer endpoints, sharply limiting the exposed population.

The CVSS 4.0 score of 6.8 (Medium) is consistent with the actual impact: local attack vector (AV:L), low privilege requirement (PR:L), no confidentiality or integrity impact (VC:N/VI:N/SC:N/SI:N), and high availability impact limited to the vulnerable system (VA:H). Despite the 'Privilege Escalation' tag in the intelligence metadata, the described impact is a service crash - not elevation of privilege or code execution - suggesting the tag may be a miscategorization or refer to the broader weakness class rather than this specific outcome. EPSS at 0.01% (2nd percentile) and SSVC exploitation status of 'none' with automatable set to 'no' and technical impact 'partial' all converge on a low real-world exploitation risk. The local-only attack vector substantially limits the attacker population to users who already have an authenticated session on the target machine. No conflicting signals exist between the CVSS vector and the description - both consistently indicate a local, authenticated, availability-only impact.

An authenticated local user on an Acer system running Care Center ≤ 4.00.3058 identifies the ACCSvc Named Pipe name, opens a connection using standard Windows API calls (e.g., CreateFile on the pipe path), and sends a crafted payload with message type identifier 0x03. The service mishandles the message and terminates with exit code 1067, disrupting any hardware monitoring or OEM support functions dependent on ACCSvc. No public proof-of-concept code has been identified at time of analysis, but the attack requires only standard low-level Windows IPC knowledge.