SYSTEM code execution via malicious OpenSSL configuration

Local privilege escalation in Veritas System Recovery before 21.2 allows local users to execute arbitrary code as SYSTEM on Windows. At service startup, the application reads C:\usr\local\ssl\openssl.cnf from a user-creatable path and follows its engine directive to load attacker-controlled code. A low-privileged Windows account can plant the file without VSR privileges; execution occurs when the service restarts and grants control over the host, or the domain if it is a domain controller.