A high-severity local privilege escalation vulnerability in the Microsoft DirectX End-User Runtime Web Installer allows a standard user to gain SYSTEM-level access.

The installer insecurely handles file downloads to a world-writable %TEMP% directory during the installation process, allowing a local authenticated user to perform a file replacement attack. Because the installer subsequently executes these files with HIGH integrity, an attacker can escalate privileges to SYSTEM level.

This vulnerability poses a significant risk to organizational security, as it provides a clear path for a standard user to achieve full administrative control over a workstation. Given the CVSS score of 8.8, this flaw represents a high risk of total system compromise, potentially leading to unauthorized data access, the deployment of persistent malware, and the complete bypass of local security controls.

Immediate Action: Monitor for any unauthorized installations or modifications to the %TEMP% directory and restrict user write permissions where possible until an official patch is released by Microsoft.

Proactive Monitoring: Review system logs for signs of service registration or suspicious process execution originating from the %TEMP% directory during software installation windows.

Compensating Controls: Implement robust Endpoint Detection and Response (EDR) policies to flag or block the execution of unsigned or unexpected binaries that are launched with elevated privileges.

Public Exploit Available: Yes — a technical write-up detailing the attack vector is available via the Talos Intelligence reference.

The ability for a low-privilege user to achieve SYSTEM-level execution represents a critical security failure in the installation process. Organizations should prioritize monitoring local user activity and restrict administrative privileges to mitigate the risk of lateral movement or full system takeover until the vendor addresses the design flaw.