An attacker with local access can place a malicious DLL in the system’s temporary directory; when DFIR‑ORC, version 10.2.7 or earlier, starts, it extracts files from that directory with administrative privileges and automatically loads the DLL, giving the attacker full control. This flaw is a classic example of CWE‑427, where DLL search order hijacking allows elevation of privilege through an absolute path override.

The vulnerability affects ANSSI’s DFIR‑ORC product, specifically releases 10.2.7 and earlier. Versions 10.2.8 and later mitigate the issue by restricting the temporary directory permissions, while version 10.3.0 provides a complete fix.

The CVSS score of 7.3 indicates a high severity risk. EPSS is not available and the flaw is not listed in the CISA KEV catalog, suggesting limited public exploitation. However, the attack requires local access to write to C:\Windows\Temp and subsequent execution of DFIR‑ORC, so the exploitation vector is local, and achieving administrative privileges is possible if the attacker can place the DLL and run the application.