CVE-2026-25865 is an unquoted search path vulnerability in Yandex Punto Switcher through version 4.5.0.583. The application calls WinExec to run RunDll32.exe without specifying a fully qualified and quoted path. This allows a local attacker to place a malicious executable in a directory that precedes the legitimate RunDll32.exe in the search order, resulting in arbitrary code execution under the privileges of the affected user.

Successful exploitation enables local attackers to execute arbitrary code with the privileges of the logged-in user, potentially leading to system compromise or unauthorized actions. The vulnerability does not require user interaction and has low attack complexity but requires local access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should restrict local access to trusted users only and avoid running Punto Switcher in untrusted environments. Monitoring for suspicious executables in directories that precede system paths may help detect exploitation attempts.