A local authenticated attacker is someone who already has a valid account or session on a device or system. Unlike a remote attacker, this person does not need to gain access over the network first. Their account may have limited permissions; the term alone does not imply administrative control.
This access can still matter when software contains a local weakness. For example, if an updater searches an unsafe location for libraries, an attacker with local access might place a malicious file where the trusted program loads it. The resulting code runs with the program’s privileges, which may be greater than the attacker’s own. Defenses include promptly applying vendor updates, limiting local access, using safe library-loading paths, and verifying that patches are installed.