IBM Aspera Desktop App versions 1.0.5 through 1.0.19 allow arbitrary code execution through the loading of DLL files at start‑up. If an attacker can supply a malicious DLL, the code runs with the application’s privileges, potentially granting full system compromise. This flaw maps to CWE‑242, Improper Control of Generation of Code.

IBM Aspera Desktop App, versions 1.0.5 to 1.0.19, are affected. The vulnerability remains present in releases up to 1.0.19 and is mitigated in version 1.1.0 released by IBM. Users of the desktop application for high‑speed file transfers should verify that they are not using the vulnerable versions.

CVSS score of 7.3 indicates a high severity vulnerability. EPSS < 1% indicates a low likelihood of exploitation, and the vulnerability is not listed in CISA KEV. The flaw appears local, requiring an attacker to place a malicious DLL in a directory accessed by the application; however, if the application is run with elevated privileges, the resulting code execution could provide system‑wide access. Without a clear remote trigger, the most likely attack path is through compromised user credentials or malicious insiders.