A DLL search path vulnerability in the Sony INZONE Hub installer allows local attackers to execute arbitrary code with the privileges of the user running the installation process.

This vulnerability is categorized as CWE-427 (Uncontrolled Search Path Element) and occurs when the installer searches for dynamic link libraries in insecure locations. It requires user interaction and local access to the system to trigger the arbitrary code execution.

Successful exploitation allows a local attacker to gain the same privilege level as the user executing the software installation. Given the CVSS score of 7.8, this represents a high risk for workstation compromise, potentially leading to unauthorized data access or the installation of persistent malicious software on the host machine.

Immediate Action: Users should avoid running the INZONE Hub installer from untrusted directories and monitor official Sony support channels for the release of a patched version.

Proactive Monitoring: Security teams should review endpoint logs for unusual child processes spawned by installation binaries or unauthorized file access attempts within the application directory.

Compensating Controls: Ensure that users have the least privilege necessary on their workstations to prevent escalated damage if an installer is compromised.

Public Exploit Available: Unknown.

The severity of this vulnerability necessitates that administrators restrict the execution of installers to trusted, read-only locations where possible. Organizations should prioritize updating the INZONE Hub software as soon as Sony publishes a remediated installer version to eliminate this insecure library loading behavior.