CVE-2026-41447 describes a DLL hijacking vulnerability in Zucchetti S.p.a.'s FirmaCheck for Windows versions prior to 1.3.16. The issue arises because FirmaCheck.exe automatically loads an OpenSSL configuration file from an unvalidated directory path (C:\Program Files (x86)\Common Files\SSL\). An attacker with local access can place a malicious openssl.cnf file referencing an attacker-controlled DLL in this directory. When FirmaCheck.exe runs at system startup, it loads the malicious DLL, resulting in arbitrary code execution at the privilege level of the startup process.

Successful exploitation allows a local attacker to execute arbitrary code with the privileges of the FirmaCheck startup process, potentially leading to full system compromise depending on those privileges. The attack requires local access and does not require user interaction. The vulnerability has a high CVSS score of 8.5, reflecting its severity and potential impact on confidentiality, integrity, and availability.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict local access to trusted users and monitor for unauthorized modifications to the C:\Program Files (x86)\Common Files\SSL\ directory. Avoid placing untrusted files in this directory.