A flaw in an undocumented section of SHFOLDER.dll in Unidocs ezPDF DRM Reader and ezPDF Reader allows an attacker who can execute code locally to manipulate the DLL search path. Such manipulation can cause the loader to load an attacker‑supplied module, granting arbitrary execution. The vulnerability is classified under CWE‑426 and CWE‑427 and is considered difficult to exploit, yet publicly available exploits exist.

The flaw affects Unidocs ezPDF DRM Reader and Unidocs ezPDF Reader 2.0 as well as version 3.0.0.4. Users running these products with the current SHFOLDER.dll package are susceptible until the vendor releases an update.

With a CVSS score of 7.3, this issue presents a moderate to high risk when a local attacker gains foothold. The EPSS score is below 1 % and the vulnerability is not yet listed in the CISA KEV catalog, but the availability of a public exploit and the potential for local code execution keep its threat significant. Attackers need local access and the exploit complexity is high, but once executed the impact can be full system compromise.