The installer for Roland Cloud Manager 3.1.19 and earlier contains an insecure DLL loading mechanism. This flaw is a classic example of a path‑based DLL injection vulnerability, identified as CWE‑427. If an attacker is able to influence which libraries are loaded during installation, they can place a malicious DLL in a location that the installer trusts and thus execute arbitrary code with the same privileges held by the application.

Vulnerable systems are those running Roland Cloud Manager for Windows, version 3.1.19 or lower. The product is distributed by Roland Corporation under the Roland Cloud Manager suite. No other products or versions are known to be affected based on the current CNA information.

The risk profile is high: CVSS 8.4 indicates a serious impact. EPSS < 1 % suggests that exploitation, while technically feasible, is expected to be infrequent. The vulnerability is not listed in the CISA KEV catalog, meaning no active exploits have been reported yet. The attack vector is inferred to be local or remote, depending on whether the attacker can run the installer or supply a custom DLL; however, the description does not explicitly state the required conditions. In either case, success would give the attacker the same rights as the application, potentially compromising system integrity or allowing further lateral movement.