The vulnerability allows an unauthenticated attacker to cause SAP GUI for Windows to load a malicious DLL from any directory within the application. Once the victim uses the application with GuiXT enabled, the DLL is executed in the victim’s user context. The impact on confidentiality, integrity, and availability is low, as the attack is executed only in the victim’s context and does not grant broader system compromise.

SAP GUI for Windows with active GuiXT is affected. No specific version numbers are provided, so all current deployments of the GUI with GuiXT enabled should be considered vulnerable.

The CVSS score of 5.0 places the vulnerability in the moderate range, but the probability of exploitation is very low. The issue is not listed in the CISA KEV catalog, suggesting no known widespread active exploitation. The likely attack vector is a social‑engineering scenario in which a user is persuaded to run the application after a malicious DLL has been placed in one of the permitted directories. No privileged escalation or remote access is required beyond the victim’s local workstation.