CVE-2026-11967
HighCVSS 8.5Summary
MobaXterm Personal Edition (Portable) version 26.3 (Build 5154) allows arbitrary code execution by loading a malicious DLL located in the same directory as the executable. The application automatically loads the winspool.drv library from that location during startup.
Risk Assessment
An attacker with local access can place a specially crafted DLL alongside the executable, leading to the execution of malicious code when the victim launches the application. This poses a significant security risk to the system.
Recommendation
It is recommended to restrict access to the directory containing MobaXterm and to monitor and scan files in that folder for potential malicious DLLs.
Original NVD description (English source)
MobaXterm Personal Edition (Portable), in its 26.3 version (Build 5154), allows arbitrary code execution by loading a malicious DLL located in the same directory as the portable executable. Because the application automatically loads the winspool.drv library from that location during startup, an attacker with local access can place a specially crafted DLL alongside the executable to be executed when the victim launches the application.