Installers supplied by PIONEER CORPORATION contain a DLL search path issue that allows insecure loading of Dynamic Link Libraries. This flaw can cause the installer to execute an attacker‑supplied DLL with the same privileges as the installer process, delivering arbitrary code execution and potentially elevating the attacker’s privileges on the target system. The vulnerability is categorized as CWE‑427, a path traversal and DLL hijacking weakness.

The affected products are all Pioneer Corporation audio devices, including the Stellanova APS‑S301 series, Stellanova Limited APS‑S202J‑LM, various Stellanova Lite models (APS‑S201JGL, APS‑S201JGR, APS‑S201JR, APS‑S201JS), and USB DAC Amplifier models (APS‑DA101JGL, APS‑DA101JGR, APS‑DA101JR, APS‑DA101JS). No specific firmware or software version details are provided in the current advisory.

The vulnerability scores a high CVSS of 8.5, indicating substantial impact if exploited. The EPSS score is below 1%, suggesting that exploitation attempts are currently uncommon, and the issue is not listed in CISA’s KEV catalog. Nevertheless, since the attack requires only the ability to run the vulnerable installer, an individual with local access or the ability to supply malicious DLLs can trigger the flaw. The mitigation is most effective by replacing the installer with a patched version or preventing the installer from loading arbitrary DLLs through environment controls.