The vulnerability arises from an uncontrolled search path element (CWE-427) in the pc-printer-updater.exe component of PaperCut Print Deploy Client on Windows. The component attempts to invoke a secondary utility using an unqualified file name rather than an absolute path, relying on the OS search order. An attacker with local access and the ability to modify directories in the search path can place a malicious binary that will be executed with SYSTEM privileges, resulting in full compromise of the affected system. The vulnerability is rated high severity with a CVSS 4.0 score of 7.3. No vendor advisory or patch information is currently available.

Successful exploitation allows a local attacker to execute arbitrary code with SYSTEM privileges on the affected host, leading to a complete compromise of the system. This elevates the attacker's privileges from limited user to full system control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local user permissions to prevent unauthorized modification of directories in the system search path and avoid running the vulnerable component with elevated privileges if possible.