OpenVPN before 2.7.7 on Windows: the tapctl utility invokes netsh via CreateProcess() with a NULL application name, so the executable is resolved through the Windows search path. A local attacker who can place a malicious netsh.exe in a directory that is searched before the system directory can achieve arbitrary code execution (binary planting) when tapctl performs adapter renaming. This issue only affects OpenVPN on Windows.