Code execution via untrusted TAK decoder loading

Uncontrolled DLL search in Mp3tag 3.26a through 3.26d allows local users to execute code by supplying a malicious TAK decoder. Mp3tag loads the external tak_deco_lib.dll used for TAK support without establishing that the decoder is trusted, so code inside a substituted library runs with the application. Exploitation requires a user to obtain and run a repackaged copy placed beside the malicious DLL; the reported consequence is code execution in that user's context.