An insecure process execution vulnerability exists in the pc-printer-updater.exe component of the PaperCut Print Deploy Client for Windows. The application, run with system privileges, performs an internal validation by invoking a secondary system utility using an unqualified file reference. Because no absolute path is specified, the OS default search order is used, allowing a malicious executable placed in a directory reachable by the system path to be executed with SYSTEM privileges. This could lead to full compromise of the host.

The affected product is the PaperCut Print Deploy Client for Windows, specifically the pc-printer-updater.exe component. The vulnerability applies to all installations of this client that do not use a fixed path for the invoked utility; version information is not provided in the advisory, so all current releases are potentially vulnerable until a patch is released.

The CVSS score of 7.3 indicates a high severity vulnerability, and the lack of an EPSS score provides no indication of current exploitation prevalence. The vulnerability is not listed in the CISA KEV catalog, but an attacker with local access who can modify directories in the system search path could execute a malicious binary. The attack vector is local with required privileges to write to path directories, and success would give SYSTEM level execution on the compromised host.