The vulnerability is a DLL Search Order Hijacking flaw identified as CWE-427. It allows a local attacker to execute arbitrary code with the same privileges that the Arena SDK application runs under. By placing a malicious DLL in a directory that is part of the PATH environment variable and is traversed by the SDK when a required dependency cannot be found locally, the attacker can coerce the SDK into loading the attacker‑supplied DLL and therefore run code at the application level.

The affected product is LUCID Vision Labs Arena SDK version 1.0.80.49, which runs on Windows.

The CVSS score of 8.8 reflects a high severity, and the vulnerability is local in nature. An attacker needs local access to a user‑controlled directory that is in the PATH list used by the SDK. The EPSS score is not available, so the likelihood of exploitation cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. While no exploit has been observed in the wild, the high CVSS score indicates that if exploitation occurs, the attacker would gain execution within the application’s privilege context.