The vulnerability identified as CVE-2026-8164 affects ArkSigner Desktop Client version 2.2.16.10. It is classified as CWE-427, which involves an uncontrolled search path element. This means the application does not securely control the directories it searches for executables or libraries, allowing an attacker with local privileges to hijack the search order and execute arbitrary code. The CVSS 3.1 vector indicates the attack requires local access with low complexity, user interaction, and privileges, but can result in high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to complete compromise of the affected system's confidentiality, integrity, and availability. An attacker with local access and limited privileges could execute arbitrary code by manipulating the search path, potentially escalating privileges or causing denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been provided by ArkSigner Software and Hardware Industry and Trade Inc. Users should monitor vendor communications for updates. Until a fix is available, avoid running the affected version in untrusted environments and limit local user privileges where possible.