The M-Audio M-Track Duo HD installer contains a DLL search path vulnerability that poses a critical risk of arbitrary code execution with administrator privileges.

This vulnerability involves an uncontrolled search path element (CWE-427) within the installer, where the application insecurely loads Dynamic Link Libraries. The vector is local, requiring user interaction, but allows an attacker to achieve code execution with administrator privileges.

The potential for arbitrary code execution with elevated privileges represents a severe security risk, as it grants an attacker full control over the affected system. Given the CVSS score of 7.8, this vulnerability is classified as High, necessitating immediate attention to prevent unauthorized system compromise and potential lateral movement within the network.

Immediate Action: Monitor the official M-Audio support channels for the release of a patched installer and apply it as soon as it becomes available.

Proactive Monitoring: Review system logs for unauthorized processes or suspicious library loads during software installation activities.

Compensating Controls: Ensure that users execute installers from secure, read-only locations and maintain strict endpoint protection policies to detect and block malicious DLL execution attempts.

Public Exploit Available: Unknown

Given the severity of potential administrative compromise, it is imperative that organizations using the M-Track Duo HD interface restrict the execution of the vulnerable installer until a vendor-provided fix is confirmed. Administrators should prioritize identifying any instances of version 1.0.0 and prepare for an immediate update once M-Audio releases the corrected software package.