CVE-2026-2516 is a vulnerability identified in Unidocs ezPDF DRM Reader versions 2.0 and 3.0.0.4 running on 32-bit systems. The root cause is an uncontrolled search path issue related to the SHFOLDER.dll library, which is part of the Windows Shell Folder API. This vulnerability allows an attacker with local access and low privileges to manipulate the search path used by the application to load DLLs. By placing a malicious DLL in a location that the application searches before the legitimate SHFOLDER.dll, an attacker can execute arbitrary code within the context of the ezPDF DRM Reader process. The attack complexity is high, indicating that exploitation requires advanced skills and specific conditions. No user interaction is necessary, and the attacker does not need elevated privileges beyond low-level local access. The vulnerability does not require network access, limiting remote exploitation. The exploit code is publicly available, increasing the risk of opportunistic attacks. The vendor was contacted but did not respond or provide patches, leaving users exposed. The CVSS 4.0 score is 7.3 (high), reflecting the significant impact on confidentiality, integrity, and availability if exploited. No mitigations or patches have been officially released, and no known active exploitation in the wild has been reported so far.

For European organizations, this vulnerability poses a significant risk especially in environments where ezPDF DRM Reader 2.0 or 3.0.0.4 is deployed on 32-bit Windows systems. Potential impacts include unauthorized code execution leading to data theft, corruption, or disruption of document workflows. Confidentiality could be compromised if sensitive documents are accessed or exfiltrated. Integrity may be affected if malicious code alters document contents or application behavior. Availability could be disrupted by denial-of-service conditions caused by malicious DLLs. Since the attack requires local access, insider threats or compromised endpoints are the primary vectors. Organizations in sectors such as government, legal, publishing, and finance that rely on ezPDF DRM Reader for protected document handling are particularly vulnerable. The lack of vendor response and patches increases the risk exposure. The public availability of exploit code raises the likelihood of exploitation attempts, especially in environments with weak endpoint security controls.

1. Restrict local access to systems running vulnerable versions of ezPDF DRM Reader by enforcing strict user account controls and limiting physical and remote desktop access. 2. Implement application whitelisting to prevent unauthorized DLLs from loading within the ezPDF DRM Reader process. 3. Use endpoint detection and response (EDR) tools to monitor for suspicious DLL loading behavior and anomalous process activity related to ezPDF DRM Reader. 4. Consider migrating to alternative PDF readers that are actively maintained and do not exhibit this vulnerability, especially on 32-bit systems. 5. If migration is not immediately feasible, isolate vulnerable systems in network segments with limited access and monitor logs for signs of local exploitation attempts. 6. Educate users about the risks of local privilege escalation and enforce policies to prevent installation of unauthorized software or execution of untrusted code. 7. Regularly audit installed software versions and remove or upgrade any instances of ezPDF DRM Reader 2.0 or 3.0.0.4 on 32-bit platforms. 8. Maintain up-to-date backups of critical documents to mitigate potential data loss from exploitation.