The Bytello Share (Windows Edition) installer executable suffers from an uncontrolled search path element vulnerability. Specifically, it insecurely loads DLLs from the directory where the installer is executed. An attacker who can place a malicious DLL in that directory can cause the installer to load and execute this DLL, resulting in arbitrary code execution with the invoking user's privileges. This vulnerability affects all versions prior to 5.13.0.4246. The CVSS 3.0 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation allows an attacker with local access to execute arbitrary code with the privileges of the user running the installer. This can lead to full compromise of the affected system under that user's context, impacting confidentiality, integrity, and availability. The vulnerability requires the attacker to place a malicious DLL in the installer's directory and for the user to run the installer.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid running the installer from untrusted directories and ensure the directory does not contain untrusted DLLs. Running the installer with least privilege and verifying the source of the installer executable can reduce risk.