The vulnerability arises from unquoted program paths in the PrinterInstallerClient component of Vasion Print Virtual Appliance Host and Windows client deployments. Specifically, the installer launches programs using an unquoted path under "C:\Program Files (x86)\Printer Properties Pro\Printer Installer". Because the path is unquoted, the Windows OS may execute a malicious program located at a short-path location such as C:\Program.exe before the legitimate binaries. An attacker able to place a program at such a location can achieve arbitrary code execution with the privileges of the installer process, which may be elevated. This can result in remote code execution and full compromise of affected Windows endpoints. The vulnerability is tracked as CWE-434 (Unrestricted Upload of File with Dangerous Type) and has a CVSS 4.0 base score of 8.6 (high severity).

Successful exploitation allows an attacker to execute arbitrary code remotely with the privileges of the driver installer process, potentially leading to full system compromise and privilege escalation on affected Windows endpoints. This can severely impact the confidentiality, integrity, and availability of the system running the vulnerable Vasion Print software.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, restricting write permissions to locations where executables might be placed and limiting the privileges of the installer process may reduce risk, but these are general mitigations and may not fully prevent exploitation.