Binary planting is a class of vulnerability where a program loads or runs an attacker-controlled executable or library from a predictable or writable location instead of a trusted system path. On Windows, this often happens through search-order behavior: if software launches a helper without using a fully qualified path, the operating system may check directories that an attacker can influence. The result is that a fake file with a trusted name can be chosen first.
This matters because it can turn an ordinary action, such as opening a document or a project folder, into code execution in the user’s context. Attackers use binary planting to hijack helper tools, plant lookalike binaries, or abuse writable working directories. Defenses are straightforward: launch executables by absolute path, avoid searching user-writable folders for program files, validate any helper you invoke, and treat workspace contents as untrusted input. The same controls also reduce broader search-order hijacking risks.