*pycharm-professional-2016.1.4.exe* loads and executes dwmapi.dll from its
For software downloaded with a web browser the applicationdirectory is
typically the user's "Downloads" directory: see <
and <http://seclists.org/fulldisclosure/2012/Aug/134> for "prior art" about
this well-known and well-documented vulnerability.
If an attacker places one of the above named DLL in the user's "Downloads"
directory (for example per "drive-by download" or "social engineering")
this vulnerability becomes a remote code execution.
Proof of concept/demonstration:
1. Create malicious dll file and save it as dwmapi.dll in your "Downloads"
2. Download pycharm-professional-2016.1.4.exe from
and save it in your "Downloads" directory.
3. Execute pycharm-professional-2016.1.4.exe from your "Downloads"
4. Malicious dll file gets executed.