CWE-427: Uncontrolled Search Path Element vulnerabilities

A DLL hijacking vulnerability within the AMD Ryzen Master installation could allow a local user-privileged attacker to escalate privileges, potentially resulting in arbitrary code execution.

A DLL hijacking vulnerability in AMD Power Design Manager could allow a malicious local attacker to escalate privileges during the uninstallation process, potentially resulting in arbitrary code execution.

A high-severity vulnerability (CWE-427) exists in LINE for Windows prior to version 26.4.0, where the application loads Msftedit.dll using a relative path without a secure DLL search path. This allows an attacker to place a malicious DLL in the installer's directory, which may be loaded instead of the legitimate system DLL.

CVE-2026-9169 is a DLL Search Order Hijacking vulnerability in LUCID Vision Labs Arena SDK version 1.0.80.49 on Windows. A local attacker can execute arbitrary code with the application's privileges by placing a malicious DLL in a directory listed in the PATH environment variable that the SDK searches when a required DLL is missing locally. This vulnerability has a high severity score of 8.8 and affects exactly version 1.0.80.49 of the Arena SDK.

An uncontrolled search path element in Kiro CLI before version 2.10.0 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a maliciously crafted project directory containing an executable that bypasses workspace trust protections when a local user starts Kiro CLI in the directory. To remediate this issue, users should upgrade to version 2.10.0 or higher.

CVE-2026-18656 is a high-severity vulnerability in Amazon Kiro IDE on Windows versions up to 1.0.212. It involves an uncontrolled search path element that allows a remote unauthenticated attacker to execute arbitrary code by placing a malicious executable in a project directory. This executable can bypass workspace trust protections when a local user opens the directory. The issue is fixed in version 1.0.228 and later.

CVE-2026-9593 is a high-severity vulnerability in the Endress+Hauser FDI Package library versions 1.00.00 up to but not including 2.01.00. It allows an attacker with elevated privileges and host system access to enable a debug interface by placing a crafted file in the application directory. This can lead to unauthorized access to connected devices and potential exposure, modification, or disruption of device data or operation. The issue is due to an uncontrolled search path element (CWE-427). A fix is available in version 2.01.00.

Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element vulnerability that could have resulted in arbitrary code execution in the context of the current user. An attacker could have exploited this vulnerability by placing a malicious library in a directory searched by the installer. Exploitation of this issue required user interaction in that a victim must have been running the installer. Scope is changed.

Uncontrolled Search Path Element vulnerability in ArkSigner Software and Hardware Industry and Trade Inc. ArkSigner Desktop Client allows Search Order Hijacking. This issue affects ArkSigner Desktop Client: from v2.2.16.10 through 17062026.

A DLL hijacking vulnerability exists in the GeoVision GV-IP Device Utility desktop application. The application loads one or more dynamic-link libraries (DLLs) from an unsafe search path, allowing a local attacker to place a malicious DLL in a location searched before the legitimate library location.

HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace the application with malicious content.

The installer of HYPER SBI 2 insecurely loads Dynamic Link Libraries. If there is a crafted DLL at the same directory when invoking the affected installer, arbitrary code may be executed with the privilege of the user invoking the installer.

Adobe Creative Cloud Desktop versions up to 6.9.1.1 are affected by an Uncontrolled Search Path Element vulnerability (CWE-427) that could allow arbitrary code execution in the context of the current user. The exploit does not require user interaction but depends on conditions beyond the attacker's control. The vulnerability has a high severity with a CVSS score of 7.8 and impacts confidentiality, integrity, and availability with changed scope.

SAProuter on Microsoft Windows allows an unauthenticated attacker to load library (DLL) files from an untrusted location, allowing them to execute malicious code on the system. This could enable the attacker to hijack the DLL loading process and achieve arbitrary code execution. This has high impact on confidentiality, integrity and availability of the system.

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

A security vulnerability has been detected in Tencent PC Manager 18.1.30242.301. This issue affects some unknown processing in the library qmudisk64.sys of the component QMUDisk Driver. The manipulation leads to uncontrolled search path. The attack must be carried out locally. The attack is considered to have high complexity. The exploitability is assessed as difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Uncontrolled search path element issue exists in Pupsman versions prior to 3.9.0. If a crafted DLL file is placed in the same folder as the affected installer and the installer is executed, arbitrary code may be executed with SYSTEM privilege.