We have an IIS application that needs to execute an exe with potentially malicious input. Multiple applications run in this app pool and I would like to limit our risk as much as possible. The executable itself is trusted, but is very possible to contain vulnerabilities (such as ImageMagick). It's possible through a buffer overflow some other mechanism, that an adversary could gain control and execute with the same privileges (i.e. the app pool user) as the original executable.
I imagine the safest course would be to create a user that has permission to do nothing more than execute this exe, and read and write to a single particular folder, but it's difficult to find a guide on how to do this.