The vulnerability arises from an uncontrolled search path element in the installers Downloader5Installer.exe, Downloader5InstallerForAdmin.exe, CanonNWCamPlugin.exe, and CanonNWCamPluginForAdmin.exe of Japan Media Systems Corporation products. These installers insecurely load Dynamic Link Libraries (DLLs) from their execution directory without proper validation, enabling an attacker who can place a malicious DLL in the same directory to have that DLL loaded and executed with the privileges of the user invoking the installer. This can result in arbitrary code execution with user-level privileges. The affected version is 1.0.0.0 of the software. The CVSS 3.0 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability.

Successful exploitation allows arbitrary code execution with the privileges of the user running the installer, potentially leading to full system compromise at the user level. Confidentiality, integrity, and availability of the affected system can be fully impacted. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid running the affected installers from untrusted directories or locations where an attacker could place a malicious DLL. Running installers with least privilege and verifying the integrity of installation files before execution may reduce risk.