SAP GUI for Windows DLL Loading Vulnerability Allowing Code Execution via GuiXT

A vulnerability in SAP GUI for Windows allows dynamic link library (DLL) files to be loaded from arbitrary directories within the application. An unauthenticated attacker could exploit this by convincing a victim to place a malicious DLL in one of these directories. If GuiXT is enabled, the executed command would run in the context of the victim user. This vulnerability has a low impact on confidentiality, integrity, and availability.

Impact

Exploitation of this vulnerability could lead to unauthorized code execution in the context of the user.

Remediation

Users are advised to consult the SAP Security Notes for guidance on addressing this vulnerability. SAP Security Notes can be accessed through the SAP for Me platform.