The vulnerability in MobaXterm Personal Edition (Portable) 26.3 (Build 5154) arises from the application automatically loading the winspool.drv DLL from the same directory as the executable during startup. Because the search path is uncontrolled, an attacker with local access can place a malicious DLL in that directory, which the application will load and execute, leading to arbitrary code execution. This is a classic example of CWE-427: Uncontrolled Search Path Element. No official patch or remediation level has been provided by the vendor as of the publication date.

An attacker with local access can execute arbitrary code with the privileges of the user running MobaXterm by placing a malicious DLL in the application directory. This can lead to full compromise of the affected system under the user's context. The vulnerability does not require user interaction beyond launching the application and has a high impact on confidentiality, integrity, and availability as indicated by the CVSS vector.

No official patch or remediation has been announced by the vendor. Until a fix is available, users should avoid running the vulnerable portable version from untrusted directories or ensure that the directory containing the executable is secure and not writable by untrusted users. Restrict local access to the system and monitor for unauthorized file placement in the application directory. Check the vendor advisory regularly for updates or official fixes.