The flaw exists in Microsoft DirectX End-User Runtime Web Installer 9.29.1974.0, where a low‑privilege user can replace a downloaded executable during installation. The installer runs with HIGH integrity, downloading files to the %TEMP% folder that is writable by standard users; the installer then executes the downloaded file with HIGH integrity. If the file is replaced with a malicious binary, the attacker’s code runs at HIGH integrity and can register a service to elevate to SYSTEM, creating a full privilege escalation chain. This vulnerability is a style of permission inversion (CWE‑284).

Windows systems that use the DirectX End‑User Runtime Web Installer version 9.29.1974.0 and allow standard users to initiate the installation are affected. No other releases are confirmed to be impacted.

The CVSS score (8.8) denotes high severity. The low EPSS (<1%) and absence from the KEV catalog suggest the exploit may not be actively used yet. The attack vector is local; an attacker only needs to run the installer with standard user permissions and replace the executable during the download phase. Because the attacker can easily alter the file prior to its execution, exploit complexity is low, giving a high likelihood of successful use if the scenario is present.