untrusted search path

The untrusted search path tag covers security vulnerabilities in Microsoft products where an application loads a resource from an unsecured location, allowing an attacker to execute arbitrary code or escalate privileges. Recent discussions include CVE-2026-25190, a high-severity code-execution flaw in Windows GDI rooted in an untrusted search path (CWE-426) that requires local access and vendor updates for mitigation. Another thread covers CVE-2025-60718, an elevation-of-privilege vulnerability in Windows Administrator Protection caused by an untrusted search path, enabling authenticated local attackers to gain administrator rights. A third thread examines CVE-2025-27743, a privilege escalation flaw in Microsoft System Center arising from an untrusted search path, affecting enterprise management environments. These threads emphasize applying vendor patches and reviewing local account exposure.