CVE-2026-13133 is a DLL search order hijacking vulnerability in LineInst.exe (LINE for Windows) versions before 26.4.0. The application loads Msftedit.dll via a relative path, lacking a secure DLL search path, enabling an attacker to place a malicious DLL in the installer's directory. When the application loads the DLL, the malicious version may be loaded ahead of the legitimate System32 copy, potentially leading to code execution or privilege escalation.

The vulnerability allows an attacker with local access to the installer's directory to execute arbitrary code by placing a malicious DLL that is loaded by the application. This can lead to high-impact consequences such as code execution with the privileges of the affected application. However, no known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid running the installer from untrusted directories and ensure the installer's directory is not writable by untrusted users.