Untrusted search path vulnerability in Winlogon in Microsoft Windows 2000 SP4 when SafeDllSearchMode is disabled allows local users to gain privileges via a malicious DLL in the UserProfile directory aka \User Profile Elevation of Privilege Vulnerability.\