Local privilege escalation via replaceable installer files

Privilege escalation in Windows driver installers from Brother, Toshiba Tec, and Ricoh allows local users to run programs as administrators. The installers or their privileged support software use files that low-privileged users can replace, causing an attacker-supplied program to run in the elevated context. Exploitation requires local low-privileged access and an installer run or another operation that requests administrative privileges, yielding arbitrary administrative code execution.