CVE-2024-7886: 
Beyond Compare vulnerability analysis and mitigation

A critical vulnerability has been identified in Scooter Software Beyond Compare versions up to 3.3.5.15075. The vulnerability affects an unknown functionality in the library 7zxa.dll, leading to an uncontrolled search path issue. The vulnerability was discovered and disclosed in August 2024, with the vendor acknowledging its existence but disputing its practical impact (NVD, VulDB).

The vulnerability is classified as critical and involves an uncontrolled search path element in the 7zxa.dll library. It has received a CVSS v4.0 base score of 8.5 (High) with the vector string CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, and a CVSS v3.1 base score of 7.8 (High) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability is identified under CWE-427 (Uncontrolled Search Path Element) and CWE-426 (Untrusted Search Path) (NVD).

The vulnerability could potentially allow an attacker with local access to execute malicious code through DLL hijacking. However, the practical impact is limited as the system must already be breached before this vulnerability can be exploited (NVD).

The vulnerability requires local access to exploit, and the complexity of the attack is considered low. However, the vendor has stated that a system must be already compromised before this vulnerability can be exploited, which significantly reduces its practical exploitability (NVD).

The vendor has acknowledged the vulnerability but has stated they are not planning to make any changes to address it, as they consider the prerequisite of system compromise to make this vulnerability practically irrelevant (NVD).