The installer for HYPER SBI 2 insecurely loads DLLs from its execution directory, allowing an attacker who can place a malicious DLL in that directory to execute arbitrary code with the privileges of the user running the installer. This is a classic uncontrolled search path element vulnerability. Exploitation requires the attacker to have the ability to place a crafted DLL alongside the installer and for the user to run the installer. The CVSS 3.0 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability, with low attack complexity but requiring user interaction and local access.

Successful exploitation allows arbitrary code execution with the privileges of the user invoking the installer, potentially leading to full compromise of the user's environment. Confidentiality, integrity, and availability impacts are all rated high. However, exploitation requires local access and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid running the installer from untrusted directories and ensure no untrusted DLLs are present in the installer's directory. Running the installer with least privilege and verifying the source of the installer can reduce risk.