CVE-2026-2516 is a vulnerability affecting Unidocs ezPDF DRM Reader versions 2.0 and 3.0.0.4 on 32-bit platforms. The root cause is an uncontrolled search path issue within the SHFOLDER.dll library, which is used by the application. This flaw allows an attacker with local access and limited privileges to manipulate the DLL search path, potentially causing the application to load malicious DLLs. The attack does not require user interaction but demands local presence and elevated privileges, making exploitation complex. The vulnerability has a CVSS 4.0 score of 7.3, indicating high severity, with high impact on confidentiality, integrity, and availability. Although no patches or vendor responses are available, a public exploit exists, increasing the risk of exploitation. The vulnerability could lead to arbitrary code execution, privilege escalation, or system compromise. The lack of vendor engagement and patch availability necessitates immediate defensive measures by organizations using the affected software.

The vulnerability poses a significant risk to organizations using Unidocs ezPDF DRM Reader 2.0 and 3.0.0.4 on 32-bit systems. Successful exploitation could allow attackers with local access to execute arbitrary code with elevated privileges, potentially leading to full system compromise. This could result in unauthorized data access, modification, or destruction, impacting confidentiality, integrity, and availability of critical information. The complexity of the attack limits widespread exploitation but the availability of a public exploit increases the threat. Organizations relying on this software for document management or DRM enforcement may face operational disruptions, data breaches, or lateral movement within networks. The absence of vendor patches prolongs exposure and increases the window for attackers to exploit this vulnerability.

Organizations should immediately restrict local access to systems running affected versions of ezPDF DRM Reader to trusted users only. Employ application whitelisting and endpoint protection solutions capable of detecting or blocking unauthorized DLL loading or path manipulation. Monitor systems for unusual DLL load behavior and local privilege escalation attempts. Consider isolating or sandboxing affected applications to limit potential damage. If possible, upgrade to newer, unaffected versions or alternative PDF readers that do not exhibit this vulnerability. In the absence of vendor patches, implement strict access controls, enforce least privilege principles, and conduct regular audits of local user activities. Additionally, educate users about the risks of local exploitation and maintain up-to-date backups to recover from potential compromises.