This vulnerability in Pupsman versions before 3.9.0 arises from an uncontrolled search path element. Specifically, if an attacker places a malicious DLL in the same directory as the installer and the installer is executed, the malicious DLL may be loaded and executed with SYSTEM privileges. The CVSS 3.0 score is 7.8, reflecting local attack vector, low attack complexity, no privileges required, but user interaction needed, and high impact on confidentiality, integrity, and availability. No official patch or remediation information is currently available.

Successful exploitation allows arbitrary code execution with SYSTEM privileges on the affected system, potentially leading to full compromise including confidentiality, integrity, and availability impacts. The attack requires local access and user interaction (running the installer). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid running installers from untrusted locations and do not place untrusted DLLs in the installer's directory. Monitor vendor communications for updates on patches or mitigations.