Multiple vendor applications designed for Microsoft Windows platforms make insecure calls to the CreateProcess() and CreateProcessAsUser() functions using unquoted Windows search paths, which could allow a local attacker to execute arbitrary code on the system. An attacker could exploit this vulnerability by placing malicious files on the victim's system that have the same name as legitimate files, which would be called by one of the affected applications allowing the attacker to execute arbitrary code on the system with elevated privileges.
Denotes that component is vulnerable