A DLL hijacking vulnerability in Doc Nav could allow a local attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.
A DLL hijacking vulnerability in Vivado could allow a local attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.
A DLL hijacking vulnerability in the AMD Software Installer could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution.
CVE-2026-25656 is a high-severity vulnerability in Siemens SINEC NMS and its User Management Component (UMC) affecting versions prior to V4.0 SP3 and V2.15.2.1 respectively. It allows a low-privileged user to improperly modify a configuration file, which can lead to loading malicious DLLs. Successful exploitation could result in arbitrary code execution with SYSTEM privileges. The vulnerability is classified under CWE-427 (Uncontrolled Search Path Element). No patch or official remediation information is currently provided by the vendor. There are no known exploits in the wild at this time.
CVE-2026-25655 is a high-severity vulnerability in Siemens SINEC NMS versions prior to V4.0 SP2. It allows a low-privileged user to improperly modify a configuration file, which can lead to loading malicious DLLs. This uncontrolled search path element vulnerability could enable arbitrary code execution with administrative privileges. There is no indication of known exploits in the wild. No official patch or remediation information is currently provided.
PsySH is a runtime developer console, interactive debugger, and REPL for PHP. Prior to versions 0.11.23 and 0.12.19, PsySH automatically loads and executes a `.psysh.php` file from the Current Working Directory (CWD) on startup. If an attacker can write to a directory that a victim later uses as their CWD when launching PsySH, the attacker can trigger arbitrary code execution in the victim's context. When the victim runs PsySH with elevated privileges (e.g., root), this results in local privilege escalation. This is a CWD configuration poisoning issue leading to arbitrary code execution in the victim user’s context. If a privileged user (e.g., root, a CI runner, or an ops/debug account) launches PsySH with CWD set to an attacker-writable directory containing a malicious `.psysh.php`, the attacker can execute commands with that privileged user’s permissions, resulting in local privilege escalation. Downstream consumers that embed PsySH inherit this risk. For example, Laravel Tinker (`php artisan tinker`) uses PsySH. If a privileged user runs Tinker while their shell is in an attacker-writable directory, the `.psysh.php` auto-load behavior can be abused in the same way to execute attacker-controlled code under the victim’s privileges. Versions 0.11.23 and 0.12.19 patch the issue.
CVE-2025-13919 is a medium severity vulnerability affecting Broadcom's Symantec Endpoint Protection Windows Client prior to versions 14.3 RU10 Patch 1, RU9 Patch 2, and RU8 Patch 3. It involves an uncontrolled search path element (CWE-427) that allows an attacker with limited privileges to hijack COM references in the Windows Registry. This hijacking can enable persistence and evasion of detection by redirecting legitimate COM object calls to malicious payloads. The vulnerability requires local access with low privileges and does not require user interaction. Although no known exploits are currently in the wild, the vulnerability impacts the integrity and availability of affected systems. European organizations relying on Symantec Endpoint Protection for endpoint security should prioritize patching to mitigate risks. Countries with significant deployments of Broadcom security products and critical infrastructure are more likely to be targeted. Mitigation involves applying vendor patches, auditing COM registry entries, and enforcing strict access controls on registry keys related to COM objects.
CVE-2025-30248 is a high-severity DLL hijacking vulnerability in the WD Discovery Installer version 5.2.730 on Windows. It allows a local attacker to execute arbitrary code by placing a malicious DLL in the installer's search path. Exploitation requires local access and user interaction during installation. The vulnerability impacts confidentiality, integrity, and availability due to potential arbitrary code execution with elevated privileges. No known exploits are currently in the wild. European organizations using Western Digital WD Discovery software on Windows systems are at risk, especially those with many local users or shared workstations. Mitigation involves restricting installer search paths, applying patches when available, and enforcing strict DLL loading policies. Countries with high Western Digital market penetration and significant enterprise usage, such as Germany, France, and the UK, are most likely affected.
Crucial Storage Executive installer versions prior to 11.08.082025.00 contain a DLL preloading vulnerability. During installation, the installer runs with elevated privileges and loads Windows DLLs using an uncontrolled search path, which can cause a malicious DLL placed alongside the installer to be loaded instead of the intended system library. A local attacker who can convince a victim to run the installer from a directory containing the attacker-supplied DLL can achieve arbitrary code execution with administrator privileges.
Discord Client Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Discord Client. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the discord_rpc module. The product loads a file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-27057.
D-Link D-View 8 versions 2.0.1.107 and below contain an uncontrolled search path vulnerability in the installer. When executed with elevated privileges via UAC, the installer attempts to load version.dll from its execution directory, allowing DLL preloading. An attacker can supply a malicious version.dll alongside the legitimate installer so that, when a victim runs the installer and approves the UAC prompt, attacker-controlled code executes with administrator privileges. This can lead to full system compromise.
NVIDIA Nsight Systems for Windows contains a vulnerability in the application’s DLL loading mechanism where an attacker could cause an uncontrolled search path element by exploiting insecure DLL search paths. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service and information disclosure.
NVIDIA Nsight Visual Studio for Windows contains a vulnerability in Nsight Monitor where an attacker can execute arbitrary code with the same privileges as the NVIDIA Nsight Visual Studio Edition Monitor application. A successful exploit of this vulnerability may lead to escalation of privileges, code execution, data tampering, denial of service, and information disclosure.
The vulnerability, if exploited, could allow an authenticated miscreant
(OS Standard User) to trick Process Optimization services into loading
arbitrary code and escalate privileges to OS System, potentially
resulting in complete compromise of the Model Application Server.
Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Standard on Windows (Nios II Command Shell modules), Altera Quartus Prime Lite on Windows (Nios II Command Shell modules) allows Search Order Hijacking.This issue affects Quartus Prime Standard: from 19.1 through 24.1; Quartus Prime Lite: from 19.1 through 24.1.
Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Standard
Installer (SFX)
on Windows, Altera Quartus Prime Lite
Installer (SFX)
on Windows allows Search Order Hijacking.This issue affects Quartus Prime Standard: from 23.1 through 24.1; Quartus Prime Lite: from 23.1 through 24.1.
Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Pro on Windows (System Console modules) allows Search Order Hijacking.This issue affects Quartus Prime Pro: from 17.0 through 25.1.1.
Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Pro
Installer (SFX)
on Windows allows Search Order Hijacking.This issue affects Quartus Prime Pro: from 24.1 through 24.3.1.
Due to insecure library loading in the Eaton UPS Companion software executable, an attacker with access to the software package
could perform arbitrary code execution . This security issue has been fixed in the latest version of EUC which is available on the Eaton download center.
