Code execution via untrusted binary search path

Untrusted search path handling in Autodesk desktop products allows local attackers to execute arbitrary code via a malicious binary file. While an affected application loads another file, its loader searches an untrusted location and executes an attacker-supplied binary in the current process; Autodesk has not disclosed the exact loader or path. Exploitation requires the malicious binary to be present locally and a user to interact with the application, giving the injected code that user's process privileges.