Local privilege escalation via bootstrap module search

Uncontrolled search path handling in PyInstaller before 6.0.0 allows local users to execute Python code through a crafted neighboring module. During frozen-application bootstrap, a special sys.path entry remains active while an absent bytecode-decryption module is imported, so an attacker-controlled namesake beside the executable is loaded. Exploitation requires a non-Windows filesystem, no bytecode encryption, write access beside the executable, knowledge of the PYZ offset, and execution of that application; elevated execution grants the injected code the same privileges.