CVE-2026-4255
HighCVSS 7.8Summary
A vulnerability in Thermalright TR-VISION HOME on Windows (64-bit) allows a local attacker to escalate privileges via DLL side-loading. The application loads DLL dependencies using the default Windows search order, allowing a malicious DLL to be placed in a user-writable directory.
Risk Assessment
The risk involves the potential execution of malicious code within the application's security context with elevated privileges, which can lead to serious security breaches within the organization.
Recommendation
It is recommended to restrict access to directories where DLLs can be placed and to implement integrity and digital signature verification mechanisms for loaded libraries.
Related vulnerabilities
- CVE-2026-90847Critical
A vulnerability was determined in EFM ipTIME C200E 1.094. The impacted element is an unknown function of the file iux_set.cgi of the component System Setup. This manipulation causes OS command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
- CVE-2026-12944Critical
IBM Langflow OSS 1.0.0 through 1.10.0 allows attackers to execute arbitrary Python code with root privileges (UID=0) on the Langflow server by submitting components containing socket or urllib imports. This enables AWS credential theft via IMDSv1 SSRF, arbitrary file exfiltration from the container filesystem, and lateral movement to internal services (PostgreSQL, Redis) within the Docker network. The scanner incorrectly returns "validated": true, providing a false security signal.
- CVE-2026-67399Critical
Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code.
- CVE-2026-65414Critical
An out-of-bounds write issue in Apple products was addressed with improved bounds checking. A remote attacker may be able to cause unexpected app termination or arbitrary code execution. This issue is fixed in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27.
- CVE-2026-53713Critical
Envoy Gateway prior to 1.7.4 and 1.8.1 does not collapse redundant separators in to_absolute_normalized_path in internal/gatewayapi/luavalidator/security.lua before is_critical_path evaluates Lua submitted through EnvoyExtensionPolicy during default Strict validation. Linux resolves a double-slash absolute path as the corresponding single-slash path, but the validator does not match the redundant-separator form, allowing submitted Lua to read arbitrary files from the gateway controller pod. Exposed files can include Kubernetes service-account tokens, TLS certificates, and process environment data, and the disclosed credentials can provide access to sensitive Kubernetes API Server or Gateway xDS server information. This issue is fixed in versions 1.7.4 and 1.8.1.
- CVE-2026-55209Critical
resdata prior to 6.2.9 insufficiently validates numeric fields, grid dimensions, keyword sizes, and array indexes while parsing untrusted GRDECL files in lib/resdata/rd_kw_grdecl.cpp and lib/resdata/rd_grid.cpp. Malformed COORD, ZCORN, CORSNUM, ACTNUM, or MAPAXES data can reach rd_grid_alloc_GRDECL_kw__ with inconsistent lengths, while unbounded floating-point conversion can exceed the intended parser buffer. In a network service that accepts untrusted GRDECL files, these conditions can cause a classic buffer overflow, out-of-bounds reads, invalid array access, NULL pointer dereference, memory corruption, or service termination. This issue is fixed in version 6.2.9.
- CVE-2026-54334Critical
UEFI Firmware Parser prior to 1.14 has a flaw in ReadCLen() in uefi_firmware/compression/Tiano/Decompress.c where reading Number from GetBits(Sd, CBIT) with CBIT = 9 can obtain 511 entries for the 510-element Sd->mCLen heap array because its loop does not enforce Index < NC. The CharC == 2 run-length path can additionally request up to 531 zero writes through Sd->mCLen[Index++] = 0. Crafted Tiano or EFI compressed firmware can corrupt heap memory, deterministically crash the parsing process, and potentially execute code. This issue is fixed in version 1.14.
- CVE-2026-54333Critical
UEFI Firmware Parser prior to 1.14 has a flaw in MakeTable() in uefi_firmware/compression/Tiano/Decompress.c that does not validate that bit-length values read from a crafted Tiano or EFI compressed firmware bitstream remain within the expected range from 0 through 16. The parsing path CompressedSection.process() to efi_compressor.TianoDecompress() to TianoDecompress() to ReadPTLen() to MakeTable() can write beyond the stack-allocated Count[17] array and related decode tables. The resulting stack corruption deterministically crashes the parsing process and may permit code execution. This issue is fixed in version 1.14.
- CVE-2026-50006Critical
Anyquery prior to 0.4.5 forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without restricting ATTACH DATABASE filesystem targets. A remote attacker can select any path writable by the Anyquery server process, cause SQLite to create a database file there, and place attacker-controlled table content in that file. This permits arbitrary file creation or overwrite, causing filesystem integrity loss and denial of service; remote code execution is possible only when another service interprets the written file or the process has a suitably privileged writable target. This issue is fixed in version 0.4.5.
- CVE-2026-16338Critical
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to perform an arbitrary file write due to improper validation of file paths.
Original NVD description (English source)
A DLL search order hijacking vulnerability in Thermalright TR-VISION HOME on Windows (64-bit) allows a local attacker to escalate privileges via DLL side-loading. The application loads certain dynamic-link library (DLL) dependencies using the default Windows search order, which includes directories that may be writable by non-privileged users.\n\n\n\nBecause these directories can be modified by unprivileged users, an attacker can place a malicious DLL with the same name as a legitimate dependency in a directory that is searched before trusted system locations. When the application is executed, which is always with administrative privileges, the malicious DLL is loaded instead of the legitimate library.\n\n\n\nThe application does not enforce restrictions on DLL loading locations and does not verify the integrity or digital signature of loaded libraries. As a result, attacker-controlled code may be executed within the security context of the application, allowing arbitrary code execution with elevated privileges.\n\n\n\nSuccessful exploitation requires that an attacker place a crafted malicious DLL in a user-writable directory that is included in the application's DLL search path and then cause the affected application to be executed. Once loaded, the malicious DLL runs with the same privileges as the application.\n\n\n\nThis issue affects \nTR-VISION HOME versions up to and including 2.0.5.