The vulnerability exists due to an insecure default configuration in libssh on Windows, where the library automatically loads configuration files from the C:\etc directory that can be created and modified by unprivileged local users, leading to untrusted search path execution.