libretro RetroArch Untrusted Search Path Vulnerability in profapi.dll Component

A vulnerability allowing for code injection via an untrusted search path has been identified in libretro RetroArch versions through 1.19.1 on Windows. The issue arises in the Startup component, specifically within the profapi.dll library. During startup, the application loads DLL files from the local installation folder, creating an opportunity to inject code into a manipulated profapi.dll file. This could potentially lead to remote code execution through DLL injection.

Impact

Exploitation of this vulnerability could allow for code execution on the affected system, with the injected code running in the context of the user.

Reproduction

To reproduce this vulnerability, place a malicious DLL file named 'profapi.dll' in the RetroArch installation directory. When RetroArch is launched, it will load the injected DLL, allowing the execution of arbitrary code.