A local user with low privileges may be able to influence the behavior of a privileged system service by manipulating configuration or application-related files located in user-writable areas of the filesystem. The affected service processes data from locations that are not sufficiently protected against modification by low-privileged users. As the service runs with elevated privileges, successful exploitation may result in a local privilege escalation.
An Uncontrolled Search Path Element vulnerability in the OpenSSL TLS backend of Qt Network (qtbase) in Qt Qt Framework (Unix) allows a local attacker to load a rogue CA certificate as a trusted system authority via a crafted certificate file placed in the application's working directory.
Mullvad VPN is a VPN client app for desktop and mobile. When using macOS with versions 2026.1 and below, Mullvad VPN may allow local privilege escalation during installation or upgrade. The installer package executes binaries from /Applications/Mullvad VPN.app without verifying if the bundle is attacker-controlled or that the path is the legitimate Mullvad application. A user in the admin group can pre-place a crafted application bundle at that location and may be able to achieve code execution as root. Since the issue only affected the installer, there is no immediate need for users to update if they are already running an older version. This issue has been fixed in version 2026.2-beta1.
Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows a user to gain SYSTEM level control of a Windows host. When started the metasploitPostgreSQL service would start the postgres.exe child process which would in turn load an OpenSSL configuration file from a static location. This static location would be writable by a pre-existing "vagrant" user, if they already existed on the system. Metasploit does not create local accounts, an Administrator would need to create it. By planting a crafted openssl.cnf file an attacker can trick the high-privilege service into executing arbitrary commands. This effectively permits the unprivileged vagrant user to bypass security controls and achieve a full host compromise under the agent's SYSTEM level access.
Unsafe OpenSSL initialization within some AMD optional tools may allow a local user-privileged attacker to inject a malicious DLL, potentially resulting in arbitrary code execution.
Privilege escalation in the mk_mysql agent plugin on Windows in Checkmk <2.4.0p29, <2.3.0p47, and 2.2.0 (EOL) allows a local unprivileged user able to create a Windows service whose name matches 'MySQL' or 'MariaDB' (or with write access to a binary referenced by such a service) to execute arbitrary code in the context of the Checkmk agent service, which typically runs as SYSTEM.
OpenClaw versions before 2026.4.23 have a vulnerability in the bundled plugin setup resolver that loads a JavaScript file from the current working directory without proper control. This allows an attacker to execute arbitrary JavaScript code under the current user account by placing a malicious setup-api.js file in a specific directory and tricking a user into running OpenClaw commands there.
ZTE ZXCLOUD iRAI's Cloud PC client uSmartView contains a DLL hijacking vulnerability (CWE-427). The vulnerable process, uSmartViewServiceAgent.exe, runs with SYSTEM privileges, allowing a local attacker to execute arbitrary code, escalate privileges, and potentially cause memory corruption. The vulnerability affects version ZXCLOUD-iRAI-ClientV7.2X. The CVSS 3.1 base score is 5.7 (medium severity). No patch or official remediation guidance is currently available, and no known exploits are reported in the wild.
CVE-2026-40004 is a medium severity vulnerability in the ZTE ZXCLOUD iRAI client (version ZXCLOUD-iRAI-ClientV7.2X) involving an uncontrolled search path element related to openssl.cnf. This flaw allows a local attacker to execute arbitrary code and escalate privileges by exploiting the improper handling of the OpenSSL configuration file. The vulnerability requires local access and user interaction, with a high attack complexity and limited privileges initially. No official patch or remediation guidance is currently available from the vendor, and no known exploits are reported in the wild.
An Uncontrolled Search Path Element vulnerability in JohnsonControls AC2000 on Windows allows Leveraging/Manipulating Configuration File Search Paths.
This issue affects AC2000: from 10.6 before release 10, from 11.0 before release 9, from 12 before release 3.
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.93212.
AVACAST developed by eMPIA Technology, has a DLL Hijacking vulnerability, allowing authenticated local attackers to place a malicious DLL in a specific directory, resulting in arbitrary code execution with system privileges when the system loads the DLL.
CVE-2026-42171 is a high-severity vulnerability in Nullsoft Scriptable Install System (NSIS) versions before 3.12, specifically 3.06.1. The issue arises because NSIS sometimes uses the Low Integrity Level (IL) temporary directory when running as SYSTEM. This behavior can allow a local attacker to gain elevated privileges if they can manipulate the function my_GetTempFileName to return 0. The vulnerability is categorized as CWE-427, indicating an uncontrolled search path element. No official patch or remediation guidance is currently available from the vendor.
EfficientLab Controlio before v1.3.95 contains a DLL hijacking vulnerability caused by weak folder permissions in the installation directory. A local attacker can place a specially crafted DLL in this directory and achieve arbitrary code execution with highest privileges, because the affected service runs as NT AUTHORITY\SYSTEM.
Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the external engine plugin loader concatenates a user-supplied engine name into a filesystem path without filtering path separators or .. components. An authenticated user with CREATE FUNCTION privileges can use a crafted ENGINE name to load an arbitrary shared library from anywhere on the filesystem via path traversal. The library's initialization code executes immediately during loading, before Firebird validates the module, achieving code execution as the server's OS account. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.
Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element vulnerability that could have resulted in arbitrary code execution in the context of the current user. An attacker could have exploited this vulnerability by placing a malicious library in a directory searched by the installer. Exploitation of this issue required user interaction in that a victim must have been running the installer. Scope is changed.
During an internal security assessment, a potential vulnerability was discovered in Lenovo Software Fix, that during installation could allow a local authenticated user to execute code with elevated privileges.
CVE-2026-1636 is a medium severity vulnerability in Lenovo Service Bridge involving an uncontrolled search path element that could lead to DLL hijacking. This issue may allow a local authenticated user to execute code with elevated privileges under certain conditions. The vulnerability has a CVSS 4.0 base score of 5.4, indicating moderate risk. No official patch or remediation guidance has been provided by Lenovo at this time. There are no known exploits in the wild. The vulnerability affects local installations of Lenovo Service Bridge and does not involve cloud services.