CVE-2026-4255 is a DLL search order hijacking vulnerability classified under CWE-829, affecting Thermalright's TR-VISION HOME software on 64-bit Windows systems, specifically versions up to 2.0.5. The vulnerability stems from the application's reliance on the default Windows DLL search order, which includes directories that may be writable by non-privileged users. Because the application runs with administrative privileges, if an attacker can place a malicious DLL with the same name as a legitimate dependency in a directory searched before trusted system locations, the malicious DLL will be loaded and executed with elevated privileges. The application lacks mechanisms to restrict DLL loading paths or verify the integrity and digital signatures of loaded DLLs, enabling arbitrary code execution. Successful exploitation requires local attacker access to write to a user-writable directory in the DLL search path and the ability to trigger execution of the vulnerable application. The CVSS 4.0 score of 8.4 reflects the high impact on confidentiality, integrity, and availability, combined with the requirement for local access and user interaction. No known exploits are currently reported in the wild. This vulnerability highlights the risks of improper DLL loading practices in privileged Windows applications.

The primary impact of this vulnerability is the potential for local privilege escalation to administrative rights on affected Windows systems running TR-VISION HOME. An attacker with local access can execute arbitrary code with elevated privileges, potentially leading to full system compromise. This could allow attackers to install persistent malware, steal sensitive information, modify system configurations, or disrupt operations. Because the application runs with administrative privileges, the scope of damage is significant. Organizations using this software on critical systems risk unauthorized control and data breaches. The requirement for local access and user interaction somewhat limits remote exploitation but does not diminish the threat in environments where local access can be obtained, such as shared workstations, compromised user accounts, or insider threats. The vulnerability could be leveraged in targeted attacks against organizations relying on this software for hardware monitoring or management.

To mitigate this vulnerability, organizations should immediately update TR-VISION HOME to a patched version once available from Thermalright. Until a patch is released, administrators should restrict write permissions on all directories included in the DLL search path to prevent unprivileged users from placing malicious DLLs. Employ application whitelisting and code integrity policies such as Windows Defender Application Control (WDAC) or AppLocker to restrict execution of unauthorized DLLs. Running the application with the least privilege necessary, rather than always with administrative rights, can reduce risk. Additionally, monitoring for unexpected DLL loads using tools like Sysinternals Process Monitor or Windows Event Logs can help detect exploitation attempts. Educate users to avoid launching the application from untrusted locations and limit local user access on critical systems. Finally, consider isolating systems running TR-VISION HOME to reduce exposure to local attackers.