Privilege escalation via installer search-path substitution

Uncontrolled search paths in installers for affected Arm development tools allow local users to gain privileges through file substitution. The installer searches an unconstrained path and loads or executes an attacker-controlled substitute instead of the intended file. Exploitation requires write access to add or replace a file in that search path, after which installer execution runs the substitute with the installer's privileges.