A local zero-day is a previously unknown vulnerability that can be exploited from the target system itself, often by code already running in a user session. It may not require remote access at first; instead, malware, a malicious document, or another local foothold abuses the flaw to change settings, read data, or interfere with trusted processes.
In cyber security, local zero-days matter because they can turn ordinary user-level access into a much stronger foothold. Attackers use them to bypass protections, redirect traffic, steal secrets, or alter security-sensitive configuration without needing administrator rights. Defenders look for unusual local behavior, harden permissions on endpoints and configuration files, and treat integrity of client-side settings as critical. In practice, a local zero-day can quietly change where an application sends data, making a trusted channel unsafe and enabling follow-on attacks such as credential theft or prompt injection.