LINE for Windows CVE-2026-13133

Exploitation requires two concurrent preconditions: (1) the attacker must have write access to the directory containing LineInst.exe - typically a user-writable location such as the Downloads folder, achievable by co-located malware running with standard user privileges, satisfying PR:N in the CVSS 4.0 vector; and (2) the victim must actively execute LineInst.exe, consistent with UI:A. The vulnerability exists only during the installation phase - the running LINE application does not inherit this DLL loading behavior. Factors that limit exploitation include the narrow timing window (attacker must stage the DLL before the user runs the installer), the requirement for a pre-existing local foothold or physical access to write to the installer directory, and the single-shot nature of the attack (opportunity disappears once installation completes or the installer is removed). Non-default conditions are NOT required to be vulnerable - any user downloading and running the installer in a writable directory (default behavior for downloaded files) meets the preconditions.

The vendor-reported CVSS 4.0 score of 8.4 (AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) reflects high local impact with no subsequent-system scope change. In practice, real-world exploitability is bounded by meaningful preconditions: the attacker must have write access to the installer's directory and the victim must actively execute the installer - a two-step local dependency that substantially narrows the attack surface compared to network-exploitable flaws. PR:N is consistent with a malware-staging scenario where an already-running co-located process (requiring only standard user privileges) pre-positions the DLL in the Downloads folder before the user launches the installer. The risk window is strictly transient - the installed application does not carry the flaw. No CISA KEV listing and no known public PoC further reduce urgency; this is not a remote, unauthenticated, or persistent threat. The 'Information Disclosure' tag in the source intelligence is likely attributable to potential credential or session data exposure via the loaded malicious DLL rather than a distinct information-leak pathway. The absence of a CWE assignment suggests the NVD record may be recently submitted; the vulnerability class is unambiguously binary planting / DLL hijacking.

An attacker who has achieved local code execution - for example, via a separate malware infection with standard user privileges - monitors the Downloads folder and, upon detecting the arrival of LineInst.exe, writes a crafted Msftedit.dll to the same directory before the user runs it. When the victim double-clicks the installer, Windows resolves the relative Msftedit.dll reference to the attacker's copy rather than the System32 version, executing arbitrary attacker-controlled code in the context of the LineInst.exe process. No public exploit code has been identified at time of analysis.