|CVSS SCORE||6.8, (AV:L/AC:L/Au:S/C:C/I:C/A:C)|
The specific flaw exists within the behavior of some MSI installations. Some installations will launch an executable as SYSTEM during uninstallation or repair. The location of this executable is read from a registry key controllable by an unprivileged user, and because a repair operation does not require elevation, a standard user can use this functionality to execute arbitrary code as SYSTEM.
Microsoft has issued an update to correct this vulnerability. More details can be found at: