The issue concerns an untrusted search path vulnerability in self-extracting archive files created by IExpress, which is bundled with Microsoft Windows. This vulnerability allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.