The vulnerability exists due to software does not perform software integrity check when downloading updates. A local user can place a malicious file on the system and the application will load it without performing an integrity check, leading to code execution.