CVE-2016-5720

High

Published: 23/01/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Multiple untrusted search path vulnerabilities in Microsoft Skype allow local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse using msi.dll, dpapi.dll, or cryptui.dll located in the current working directory.

Risk Assessment

This vulnerability poses a risk to organizations as local users can exploit it to run malicious code, potentially leading to data loss or system compromise.

Recommendation

It is recommended to restrict access to working directories and to monitor and control applications that can be executed by local users to minimize the risk of this vulnerability being exploited.

Other vulnerabilities in Microsoft Skype

CVE-2017-6517Critical
Microsoft Skype version 7.16.0.102 contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system. The issue arises from the way .dll files are loaded by Skype.

Original NVD description (English source)

Multiple untrusted search path vulnerabilities in Microsoft Skype allow local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) msi.dll, (2) dpapi.dll, or (3) cryptui.dll that is located in the current working directory.