CVE-2026-41447 is a DLL hijacking vulnerability in Zucchetti S.p.a.'s FirmaCheck for Windows before version 1.3.16. The flaw arises from an untrusted search path where FirmaCheck.exe loads configuration and DLL files from an unvalidated directory (C:\Program Files (x86)\Common Files\SSL\). An attacker with local access can place a crafted openssl.cnf file referencing a malicious DLL in this directory. When FirmaCheck.exe runs automatically at system startup, it loads the attacker-controlled DLL, resulting in arbitrary code execution at the privilege level of the startup process.

Successful exploitation allows local attackers to execute arbitrary code with the privileges of the FirmaCheck startup process, potentially leading to full system compromise depending on those privileges. The vulnerability does not require user interaction and has a high CVSS 4.0 score of 8.5, indicating significant impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to the affected directory (C:\Program Files (x86)\Common Files\SSL\) to trusted users only to prevent placement of malicious files. Monitor for unauthorized files in this directory and consider disabling automatic startup of FirmaCheck.exe if feasible.