What is the CVSS score of CVE-2026-25676?

CVE-2026-25676 has a CVSS 3.0 base score of 7.8 (High). CVSS vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-25676?

Within 24 hours: Inventory all systems running M-Track Duo HD 1.0.0 and isolate them from production networks if possible; notify affected users to avoid launching the application. Within 7 days: Contact M-Track vendor for patch timeline; if unavailable, uninstall affected software or restrict installation to trusted administrative personnel only in isolated environments. Within 30 days: Either apply vendor patch immediately upon release or implement permanent mitigations (see compensating controls); document approval for any continued use without patching.

CVE-2026-25676

HIGH

Uncontrolled Search Path Element (CWE-427)

2026-02-12 vultures@jpcert.or.jp

Privilege Escalation RCE

7.8

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 12, 2026 - 05:17 nvd

HIGH 7.8

DescriptionCVE.org

The installer of M-Track Duo HD version 1.0.0 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with administrator privileges.

AnalysisAI

M-Track Duo HD version 1.0.0 installer is vulnerable to DLL hijacking due to improper library search path handling, enabling local attackers to execute arbitrary code with administrator privileges. An attacker with local access and user interaction can exploit this vulnerability by placing malicious DLLs in predictable locations to gain full system compromise. No patch is currently available for this high-severity vulnerability.

Technical ContextAI

Classified as CWE-427 (Uncontrolled Search Path Element). The installer of M-Track Duo HD version 1.0.0 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with administrator privileges.

Affected ProductsAI

The installer of M-Track Duo HD version 1.0.0 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries.