Code execution via attacker-controlled executable search path

Untrusted search path handling in Adobe Acrobat Reader allows local users to execute code when a malicious file is opened. The application resolves critical programs through a search path that an attacker can redirect to a malicious executable, then launches that substituted program. Opening the crafted file is required, and successful exploitation runs the attacker's code with the current user's privileges.