CVE-2010-3145

CVE-2010-3145 describes an untrusted search path vulnerability in the BitLocker Drive Encryption API, specifically within sdclt.exe (Backup Manager) in Microsoft Windows Vista SP1 and SP2. This flaw allows local attackers to achieve privilege escalation by placing a malicious fveapi.dll file in a directory that contains a Windows Backup Catalog (.wbcat) file, leading to the loading of the attacker's DLL. With a CVSS score of 9.3, this vulnerability is considered critical due to its potential for complete compromise of confidentiality, integrity, and availability. While not listed on CISA's KEV catalog, an ExploitDB entry exists, indicating public exploit code, though there is no evidence of widespread active exploitation or significant community discussion.