This vulnerability (CWE-427) involves an uncontrolled search path element in ANSSI's DFIR-ORC software. Specifically, the application is executed from the Windows temporary directory and loads DLLs from there. An attacker who already has limited access to the system can place a malicious DLL in the temporary directory. When DFIR-ORC runs with administrative privileges, it loads the attacker's DLL, resulting in local privilege escalation. The vulnerability affects versions 10.2.7 and prior. No official patch or remediation level is currently documented.

An attacker with prior access to the affected system can escalate their privileges to administrator by exploiting the DLL search path vulnerability. This allows execution of arbitrary code with elevated privileges, potentially compromising the entire system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid running DFIR-ORC from shared or temporary directories where untrusted users can place files. Restrict write permissions to the C:\Windows\Temp directory and monitor for unauthorized DLL files. Consider running the application with least privilege where possible.