OBS Studio Untrusted Search Path Vulnerability Allowing DLL Injection

A vulnerability exists in OBS Studio versions up to 30.0.2 on Windows, related to how the application loads dynamic link library (DLL) files. The issue arises from an untrusted search path that can be exploited to inject malicious code into DLLs, potentially leading to remote code execution. This vulnerability requires local access to the affected system.

Impact

Exploitation of this vulnerability allows for command injection through DLL injection, with the possibility of remote code execution.

Reproduction

The vulnerability can be reproduced by placing a malicious 'profapi.dll' file in the OBS Studio installation directory. During startup, OBS Studio loads DLLs from this directory, including the injected 'profapi.dll'. If the application is configured to execute code from this DLL, the injected code will be executed, demonstrating the vulnerability.

Remediation

Users are advised to update to the patched version of OBS Studio, which is available on the OBS Project website.