CWE-427: Uncontrolled Search Path Element vulnerabilities

CVE-2026-5397 is a high-severity vulnerability in OMRON SOCIAL SOLUTIONS CO. , Ltd. 's PowerAttendant Standard Edition (version 2.1.2 or lower). The issue arises from improper permissions on the installation directory, allowing an attacker with local access to place a malicious DLL. This DLL may be loaded and executed with administrator privileges during the service startup due to the product's behavior of loading missing DLLs from its installation directory. No official patch or remediation guidance is currently available from the vendor. The vulnerability has not been reported as exploited in the wild.

MemProcFS before 5.17 contains multiple unsafe library-loading patterns that enable DLL and shared-library hijacking across six attack surfaces, including bare-name LoadLibraryU and dlopen calls without path qualification for vmmpyc, libMSCompression, and plugin DLLs. An attacker who places a malicious DLL or shared library in the working directory or manipulates LD_LIBRARY_PATH can achieve arbitrary code execution when MemProcFS loads.

This update includes the following RPMs:

CVE-2026-27774 is a local privilege escalation vulnerability in Acronis True Image for Windows versions before build 42902. It arises from a DLL hijacking issue (CWE-427) that could allow a local attacker to escalate privileges. The vulnerability has a CVSS 3.0 score of 6.7, indicating a medium severity level. No official patch or remediation details are provided in the available information. There are no known exploits in the wild at this time.

CVE-2026-28728 is a local privilege escalation vulnerability in Acronis True Image for Windows versions before build 42902. It arises from a DLL hijacking issue (CWE-427) that could allow an attacker with limited privileges to escalate their rights on the affected system. The vulnerability has a CVSS 3.0 base score of 6.7, indicating a medium severity level. No official patch or remediation information is currently available from the vendor. There are no known exploits in the wild at this time.

CVE-2026-3775 is a high-severity DLL hijacking vulnerability affecting Foxit PDF Editor versions 2025.3 and earlier. The vulnerability arises because the application's update service loads system libraries from search paths that include directories writable by low-privileged users. This allows a local attacker to place a malicious DLL in such a directory, which the update service then loads with SYSTEM privileges, leading to local privilege escalation and arbitrary code execution. There is currently no official patch or remediation available from the vendor, and no known exploits have been reported in the wild.

CVE-2026-34054 is a high-severity vulnerability in Microsoft vcpkg, a C/C++ package manager. Prior to version 3.6.1#3, the Windows builds of OpenSSL within vcpkg set the openssldir to a path on the build machine. This configuration could be exploited on customer machines due to an uncontrolled search path element (CWE-427). The issue has been patched in version 3.6.1#3.

ScreenToGif is a screen recording tool. In versions from 2.42.1 and prior, ScreenToGif is vulnerable to DLL sideloading via version.dll . When the portable executable is run from a user-writable directory, it loads version.dll from the application directory instead of the Windows System32 directory, allowing arbitrary code execution in the user's context. This is especially impactful because ScreenToGif is primarily distributed as a portable application intended to be run from user-writable locations. At time of publication, there are no publicly available patches.

IBM Trusteer Rapport installer 3.5.2309.290 IBM Trusteer Rapport could allow a local attacker to execute arbitrary code on the system, caused by DLL uncontrolled search path element vulnerability. By placing a specially crafted file in a compromised folder, an attacker could exploit this vulnerability to execute arbitrary code on the system.

SAP GUI for Windows allows DLL files to be loaded from arbitrary directories within the application. An unauthenticated attacker could exploit this vulnerability by persuading a victim to place a malicious DLL within one of these directories. The malicious command is executed in the victim user's context provided GuiXT is enabled. This vulnerability has a low impact on confidentiality, integrity, and availability.

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186.

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186.

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 41124.

Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries (docker-compose.exe, docker-buildx.exe, etc.) that are executed when a victim user opens Docker Desktop or invokes Docker CLI plugin features, and allow privilege-escalation if the docker CLI is executed as a privileged user. This issue affects Docker CLI: through 29.1.5 and Windows binaries acting as a CLI-plugin manager using the github.com/docker/cli/cli-plugins/manager https://pkg.go.dev/github.com/docker/cli@v29.1.5+incompatible/cli-plugins/manager  package, such as Docker Compose. This issue does not impact non-Windows binaries, and projects not using the plugin-manager code.

Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an uncontrolled search path element vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to denial of service, elevation of privileges, and information disclosure.

Dell Command | Intel vPro Out of Band, versions prior to 4.7.0, contain an Uncontrolled Search Path Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

Dell Repository Manager (DRM), versions prior to 3.4.8, contains an Uncontrolled Search Path Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary code execution and escalation of privileges.

CVE-2026-2040 is a local privilege escalation vulnerability in PDF-XChange Editor version 10.7.2.400. It arises from an uncontrolled search path element in the TrackerUpdate process, which loads a library from an unsecured location. An attacker with the ability to execute low-privileged code on the system can exploit this flaw to escalate privileges and execute code with higher user rights. The vulnerability has a CVSS score of 7.3, indicating high severity. No patch or official remediation information is currently available.

Uncontrolled Search Path Element in Owl opds 2.2.0.4 allows Leveraging/Manipulating Configuration File Search Paths via a crafted network request.

Uncontrolled Search Path Element in Owl opds 2.2.0.4 allows Leveraging/Manipulating Configuration File Search Paths via a crafted network request.