IBM Trusteer Rapport installer 3.5.2309.290 contains an uncontrolled search path element flaw that allows a local attacker to drop a malicious file into a directory traversed during the installation process. By exploiting this vulnerability the attacker can run arbitrary code with the privileges of the installer, leading to full system compromise. The weakness is a classic CWE‑427: Uncontrolled Search Path Element. The impact is limited to local systems that run the installer, and does not affect an already‑installed Rapport product.

The vulnerability is specific to the IBM Trusteer Rapport installer version 3.5.2309.290, affecting installations on macOS and Windows platforms. Only the installer is impacted; the Rapport application itself is not vulnerable. All public download links have been updated to version 3.5.2504.127, which addresses the flaw.

With a CVSS score of 7.4 the flaw is considered high severity. The EPSS score is below 1%, indicating low current exploitation probability, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is local, requiring the attacker to have access to the target machine to place a crafted file in the search path directory during installation.