A DLL hijacking vulnerability in various Japan Media Systems Corporation installers allows local attackers to execute arbitrary code with user privileges.

The vulnerability is an uncontrolled search path element (CWE-427) where the affected installers insecurely load Dynamic Link Libraries. An unauthenticated local attacker can place a malicious DLL in the installer directory to achieve arbitrary code execution when the installer is launched by a user.

The potential for arbitrary code execution poses a severe risk to endpoint integrity and security. A successful exploit could lead to full system compromise, unauthorized data access, or the deployment of further malicious payloads, justifying the high CVSS score of 7.8.

Immediate Action: Cease the use of the affected installer versions and consult the vendor advisory at JVN45563482 for guidance on secure installation methods or available updates.

Proactive Monitoring: Audit local file systems for unauthorized DLL files placed in application directories and monitor process creation logs for unexpected execution chains originating from installer paths.

Compensating Controls: Restrict write permissions on directories where software installers are stored and utilize application whitelisting or endpoint detection and response (EDR) tools to block unauthorized DLL loading behaviors.

Public Exploit Available: Unknown.

Given the potential for complete control over the affected system, organizations should prioritize restricting the execution of these specific installers. Ensure that all software deployment processes occur within hardened environments and monitor for any abnormal activity during installation cycles.