The FinalCode Client installer from Digital Arts Inc. is vulnerable because it uses a DLL search path that can be manipulated. If an attacker or a privileged user places a malicious DLL file into the same directory as the installer and runs the installer, the malicious code will be loaded and executed with the installer’s privileges. This flaw is a classic example of DLL Search Path Manipulation, identified as CWE‑427, allowing attackers to gain executable control over the installation process.

Both the FinalCode Ver.5 and Ver.6 series produced by Digital Arts Inc. are affected. Users running these installers on any Windows platform where the installer is executed from a directory containing a malicious DLL are at risk.

The vulnerability carries a CVSS score of 8.4 and a very low EPSS score of less than 1%, indicating that while the flaw is severe, the likelihood of exploitation is low and it has not been reported in the CISA KEV catalog. The attack vector is inferred to be local – the attacker must have the ability to place files in the installer’s directory and execute the installer, so it typically requires either a privileged user or compromised credentials. If achieved, the attacker can run arbitrary code with the installer’s execution privilege.