CVE-2022-36415: 
Beyond Compare vulnerability analysis and mitigation

A DLL hijacking vulnerability exists in the uninstaller in Scooter Beyond Compare versions 1.8a through 4.4.2 before 4.4.3 when installed via the EXE installer. The vulnerability was discovered in July 2022 and assigned identifier CVE-2022-36415 (NVD, CVE).

The vulnerability occurs because the uninstaller attempts to load DLLs from a Windows Temp folder. When the uninstaller is executed with SYSTEM privileges, it will attempt to load DLLs from the C:\Windows\Temp\ directory without proper validation (Scooter Software).

If successfully exploited, this vulnerability allows a standard user to execute malicious DLLs with elevated SYSTEM privileges when the uninstaller is run. This could lead to privilege escalation and arbitrary code execution with the highest system privileges (CVE).

The vulnerability requires local access and can only be exploited during the uninstallation process. An attacker needs to have standard user privileges to place malicious DLLs in the C:\Windows\Temp\ folder, and the exploitation is only successful when the uninstaller is executed with SYSTEM privileges (NVD).

The vulnerability has been fixed in Beyond Compare version 4.4.3. Users are advised to update to version 4.4.3 or newer to remediate this issue (Scooter Software).

The vulnerability was discovered and reported by the Lockheed Martin Red Team, demonstrating collaborative security research between software vendors and security teams (Scooter Software).