The installer for OM Workspace (Windows Edition) versions 2.4 and earlier shears improper mechanisms for loading Dynamic Link Libraries, which permits attackers to introduce malicious DLLs that are executed with the privileges of the user running the installer. This flaw maps to CWE‑427 and can lead to full arbitrary code execution under the account that installs the software. The potential impact includes data theft, system compromise, or propagation of malware across the network. The vulnerability is limited to the installation process, though the code executed gains whatever privileges the installing user possesses.

OM Digital Solutions Corporation’s OM Workspace (Windows Edition) is affected when its installer is used for version 2.4 or earlier. No additional sub‑products or version ranges are listed.

The CVSS score of 8.4 indicates a high severity due to the remote code execution capability. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be local or user‑level, requiring an attacker to deliver a malicious DLL to a machine where a user with installation privileges runs the installer. Successful exploitation would grant the attacker the same rights as the installing user.