CVE-2026-112161
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk0th percentile - higher than 0% of all known CVEs
Summary
MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the bin/cygwin1.dll library contained within it with a malicious library. When the victim opens a Local Shell session or uses a Cygwin-based function, the application extracts the component and loads the tampered library, executing code with the victim's permissions.
Risk Assessment
An attacker could execute arbitrary code in the victim's context, potentially leading to system compromise or data theft.
Recommendation
Update MobaXterm to a version that verifies the integrity of plugin files. Restrict write permissions to plugin files to trusted users only.
Other vulnerabilities in MobaXterm
See all- CVE-2026-25866High
MobaXterm versions prior to 26.1 contain an uncontrolled search path element vulnerability. The application calls WinExec to execute Notepad++ without a fully qualified executable path when opening remote files.
- CVE-2015-7244High
The default configuration of the server in MobaXterm before version 8.3 has a disabled Access Control setting, resulting in no authentication requirement for X11 connections. This allows remote attackers to execute arbitrary commands or obtain sensitive information via X11 packets.
- CVE-2019-25741Critical
Mobatek MobaXterm version 12.1 has a buffer overflow vulnerability in the username field of session files. A remote attacker can craft a malicious session file that, when imported and executed, triggers a buffer overflow and allows arbitrary code execution.
Original NVD description (English source)
MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the ‘bin/cygwin1.dll’ library contained within it with a malicious library. When the victim opens a Local Shell session or uses a Cygwin-based function, the application extracts the component and loads the tampered library, executing code with the victim’s permissions. Exploitation requires write access to the plugin and does not, in itself, involve privilege escalation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS