Local privilege escalation via uncontrolled search path

Uncontrolled search path handling in Microsoft Visual Studio Installer allows local users to elevate privileges through user interaction. Microsoft has not published which Installer executable or search operation uses the attacker-controlled path element. Exploitation requires low privileges, local access, and user interaction; successful exploitation runs attacker-controlled code with elevated privileges.