Local code execution via untrusted search path

Untrusted search path handling in Microsoft Office Click-to-Run products allows local users to execute code through user interaction. Microsoft identifies the affected locus as Click-to-Run search-path handling but has not disclosed the executable, library, or lookup sequence that accepts an attacker-controlled path. Exploitation requires local access and user interaction and runs attacker-supplied code with the affected user's access to data and services.