CVE-2026-11980 affects IBM Aspera Desktop App versions 1.0.5 through 1.0.19. The vulnerability arises from the application's unsafe loading of DLL files during start-up, which can lead to arbitrary code execution. This is categorized under CWE-242, indicating the use of inherently dangerous functions that do not properly validate input or execution context. The CVSS 3.1 base score is 7.3, reflecting high impact on confidentiality, integrity, and availability. No known exploits are reported in the wild, and no official remediation or patch has been announced by IBM as of the publication date.

Successful exploitation of this vulnerability could allow an attacker with local access and limited privileges to execute arbitrary code with the privileges of the affected application. This could lead to full compromise of the system's confidentiality, integrity, and availability. The vulnerability requires user interaction and local access, which limits remote exploitation potential.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should limit local access to trusted users only and avoid running the affected versions in untrusted environments. Monitor IBM's official channels for updates and patches.