Punto Switcher up to version 4.5.0.583 includes an unquoted search path element vulnerability. The application calls WinExec without providing a fully qualified path for RunDll32.exe, which means that if an attacker can place a malicious file earlier in the search order, the application will execute that file instead of the intended system library. This flaw allows a local user to run arbitrary code with the privileges of the affected process, effectively enabling local privilege escalation and arbitrary code execution.

Yandex Punto Switcher versions through 4.5.0.583 are affected. Users running any of these releases without an updated version are at risk.

The CVSS score of 8.5 reflects a high‑severity local exploitation scenario. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the flaw remains dangerous because any local user who can influence the search order can trigger execution of arbitrary code. Attackers can achieve this by placing a malicious executable earlier in the search path, allowing the application to run it in the context of the affected user. The lack of network exposure limits the attack surface to local users, but the consequences of successful exploitation are severe.